Changeset 84681 in webkit

Timestamp:

Apr 22, 2011 2:20:12 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-04-22 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP frame-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58643

Update expected result to show that this test is passing now.

• http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt:

2011-04-22 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP frame-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58643

In this patch, I've audited all the callers to
SecurityOrigin::canDisplay to make sure they all the appropriate
Content-Security-Policy method as well. I'm not sure how to test all
these cases, but making this changes fixed the frame-src test.

• loader/SubframeLoader.cpp: (WebCore::SubframeLoader::loadMediaPlayerProxyPlugin): (WebCore::SubframeLoader::createJavaAppletWidget): (WebCore::SubframeLoader::loadSubframe): (WebCore::SubframeLoader::loadPlugin):
• loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::create):
• loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::canRequest): (WebCore::CachedResourceLoader::requestResource):
  • While I was understanding this code, I fixed the FIXME here.
• loader/cache/CachedResourceLoader.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/SubframeLoader.cpp (modified) (4 diffs)
• Source/WebCore/loader/SubresourceLoader.cpp (modified) (1 diff)
• Source/WebCore/loader/cache/CachedResourceLoader.cpp (modified) (3 diffs)
• Source/WebCore/loader/cache/CachedResourceLoader.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP frame-src is missing
+        https://bugs.webkit.org/show_bug.cgi?id=58643
+
+        Update expected result to show that this test is passing now.
+
+        * http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt:
+
 2011-04-22  Levi Weintraub  <leviw@chromium.org>
 

trunk/LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt

@@ -1 @@
-ALERT: FAIL
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
 
+

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP frame-src is missing
+        https://bugs.webkit.org/show_bug.cgi?id=58643
+
+        In this patch, I've audited all the callers to
+        SecurityOrigin::canDisplay to make sure they all the appropriate
+        Content-Security-Policy method as well.  I'm not sure how to test all
+        these cases, but making this changes fixed the frame-src test.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::loadMediaPlayerProxyPlugin):
+        (WebCore::SubframeLoader::createJavaAppletWidget):
+        (WebCore::SubframeLoader::loadSubframe):
+        (WebCore::SubframeLoader::loadPlugin):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        (WebCore::CachedResourceLoader::requestResource):
+            - While I was understanding this code, I fixed the FIXME here.
+        * loader/cache/CachedResourceLoader.h:
+
 2011-04-22  Adrienne Walker  <enne@google.com>
 

trunk/Source/WebCore/loader/SubframeLoader.cpp

@@ -162 +162 @@
     }
 
+    if (!m_frame->document()->contentSecurityPolicy()->allowMediaFromSource(completedURL))
+        return 0;
+
     HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(node);
     RenderPart* renderer = toRenderPart(node->renderer());
@@ -208 +211 @@
             return 0;
         }
+
+        if (!element->document()->contentSecurityPolicy()->allowObjectFromSource(codeBaseURL))
+            return 0;
     }
 
@@ -250 +256 @@
         return 0;
     }
+
+    if (!ownerElement->document()->contentSecurityPolicy()->allowChildFrameFromSource(url))
+        return 0;
 
     bool hideReferrer = SecurityOrigin::shouldHideReferrer(url, referrer);
@@ -340 +349 @@
     }
 
+    if (!document()->contentSecurityPolicy()->allowObjectFromSource(url))
+        return false;
+
     FrameLoader* frameLoader = m_frame->loader();
     frameLoader->checkIfRunInsecureContent(document()->securityOrigin(), url);

trunk/Source/WebCore/loader/SubresourceLoader.cpp

@@ -77 +77 @@
     }
 
+    // Note: We skip the Content-Security-Policy check here because we check
+    // the Content-Security-Policy at the CachedResourceLoader layer so we can
+    // handle different resource types differently.
+
     String outgoingReferrer;
     String outgoingOrigin;

trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

@@ -196 +196 @@
 #endif
 
-bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url)
-{
+bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url, bool forPreload)
+{
+    if (!document()->securityOrigin()->canDisplay(url)) {
+        if (!forPreload)
+            FrameLoader::reportLocalLoadFailed(document()->frame(), url.string());
+        LOG(ResourceLoading, "CachedResourceLoader::requestResource URL was not allowed by SecurityOrigin::canDisplay");
+        return 0;
+    }
+
     // Some types of resources can be loaded only from the same origin.  Other
     // types of resources, like Images, Scripts, and CSS, can be loaded from
@@ -229 +236 @@
     //       update any security indicators.
     // 
+    // FIXME: Should we consider forPreload here?
+    //
     switch (type) {
     case CachedResource::Script:
@@ -297 +306 @@
     if (!url.isValid())
         return 0;
-    
-    if (!canRequest(type, url))
+
+    if (!canRequest(type, url, forPreload))
         return 0;
-
-    // FIXME: Figure out what is the correct way to merge this security check with the one above.
-    if (!document()->securityOrigin()->canDisplay(url)) {
-        if (!forPreload)
-            FrameLoader::reportLocalLoadFailed(document()->frame(), url.string());
-        LOG(ResourceLoading, "CachedResourceLoader::requestResource URL was not allowed by SecurityOrigin::canDisplay");
-        return 0;
-    }
 
     if (memoryCache()->disabled()) {

trunk/Source/WebCore/loader/cache/CachedResourceLoader.h

@@ -119 +119 @@
     
     void notifyLoadedFromMemoryCache(CachedResource*);
-    bool canRequest(CachedResource::Type, const KURL&);
+    bool canRequest(CachedResource::Type, const KURL&, bool forPreload = false);
 
     void loadDoneActionTimerFired(Timer<CachedResourceLoader>*);