Changeset 85451 in webkit


Ignore:
Timestamp:
May 1, 2011 6:44:27 PM (13 years ago)
Author:
abarth@webkit.org
Message:

2011-05-01 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP default-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58641

Test that default-src controls some scripting policy and that
script-src, if present, overrides default-src. In principle, we could
test the interaction of default-src with every other directive, but
that seems like overkill.

  • http/tests/security/contentSecurityPolicy/default-src-inline-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/default-src-inline-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/script-src-overrides-default-src-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html: Added.

2011-05-01 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP default-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58641

Add support for default-src. The default-src provides a default policy
for every directive that sends in "-src". If the more-specific
directive is present, it takes precedence. I also took this
opportunity to refactor the internals of ContentSecurityPolicy a bit to
reduce duplicate code.

Tests: http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html

http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html
http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html

  • page/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::didReceiveHeader): (WebCore::ContentSecurityPolicy::checkEval): (WebCore::ContentSecurityPolicy::operativeDirective): (WebCore::ContentSecurityPolicy::checkInlineAndReportViolation): (WebCore::ContentSecurityPolicy::checkEvalAndReportViolation): (WebCore::ContentSecurityPolicy::checkSourceAndReportViolation): (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): (WebCore::ContentSecurityPolicy::allowInlineEventHandlers): (WebCore::ContentSecurityPolicy::allowInlineScript): (WebCore::ContentSecurityPolicy::allowInlineStyle): (WebCore::ContentSecurityPolicy::allowEval): (WebCore::ContentSecurityPolicy::allowScriptFromSource): (WebCore::ContentSecurityPolicy::allowObjectFromSource): (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): (WebCore::ContentSecurityPolicy::allowImageFromSource): (WebCore::ContentSecurityPolicy::allowStyleFromSource): (WebCore::ContentSecurityPolicy::allowFontFromSource): (WebCore::ContentSecurityPolicy::allowMediaFromSource): (WebCore::ContentSecurityPolicy::addDirective):
  • page/ContentSecurityPolicy.h:
Location:
trunk
Files:
6 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r85436 r85451  
     12011-05-01  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CSP default-src is missing
     6        https://bugs.webkit.org/show_bug.cgi?id=58641
     7
     8        Test that default-src controls some scripting policy and that
     9        script-src, if present, overrides default-src.  In principle, we could
     10        test the interaction of default-src with every other directive, but
     11        that seems like overkill.
     12
     13        * http/tests/security/contentSecurityPolicy/default-src-inline-allowed-expected.txt: Added.
     14        * http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html: Added.
     15        * http/tests/security/contentSecurityPolicy/default-src-inline-blocked-expected.txt: Added.
     16        * http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html: Added.
     17        * http/tests/security/contentSecurityPolicy/script-src-overrides-default-src-expected.txt: Added.
     18        * http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html: Added.
     19
    1202011-05-01  Justin Schuh  <jschuh@chromium.org>
    221

  • trunk/Source/WebCore/ChangeLog

    r85442 r85451  
     12011-05-01  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CSP default-src is missing
     6        https://bugs.webkit.org/show_bug.cgi?id=58641
     7
     8        Add support for default-src.  The default-src provides a default policy
     9        for every directive that sends in "-src".  If the more-specific
     10        directive is present, it takes precedence.  I also took this
     11        opportunity to refactor the internals of ContentSecurityPolicy a bit to
     12        reduce duplicate code.
     13
     14        Tests: http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html
     15               http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html
     16               http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html
     17
     18        * page/ContentSecurityPolicy.cpp:
     19        (WebCore::ContentSecurityPolicy::didReceiveHeader):
     20        (WebCore::ContentSecurityPolicy::checkEval):
     21        (WebCore::ContentSecurityPolicy::operativeDirective):
     22        (WebCore::ContentSecurityPolicy::checkInlineAndReportViolation):
     23        (WebCore::ContentSecurityPolicy::checkEvalAndReportViolation):
     24        (WebCore::ContentSecurityPolicy::checkSourceAndReportViolation):
     25        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
     26        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
     27        (WebCore::ContentSecurityPolicy::allowInlineScript):
     28        (WebCore::ContentSecurityPolicy::allowInlineStyle):
     29        (WebCore::ContentSecurityPolicy::allowEval):
     30        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
     31        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
     32        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
     33        (WebCore::ContentSecurityPolicy::allowImageFromSource):
     34        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
     35        (WebCore::ContentSecurityPolicy::allowFontFromSource):
     36        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
     37        (WebCore::ContentSecurityPolicy::addDirective):
     38        * page/ContentSecurityPolicy.h:
     39
    1402011-05-01  Sam Weinig  <sam@webkit.org>
    241

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r85388 r85451  
    471471    m_havePolicy = true;
    472472
    473     if (!internalAllowEval()) {
     473    if (!checkEval(operativeDirective(m_scriptSrc.get()))) {
    474474        if (Frame* frame = m_document->frame())
    475475            frame->script()->disableEval();
    … …  
    509509}
    510510
     511bool ContentSecurityPolicy::checkEval(CSPDirective* directive) const
     512{
     513    return !directive || directive->allowEval();
     514}
     515
     516CSPDirective* ContentSecurityPolicy::operativeDirective(CSPDirective* directive) const
     517{
     518    return directive ? directive : m_defaultSrc.get();
     519}
     520
     521bool ContentSecurityPolicy::checkInlineAndReportViolation(CSPDirective* directive, const String& consoleMessage) const
     522{
     523    if (!directive || directive->allowInline())
     524        return true;
     525    reportViolation(directive->text(), consoleMessage);
     526    return false;
     527}
     528
     529bool ContentSecurityPolicy::checkEvalAndReportViolation(CSPDirective* directive, const String& consoleMessage) const
     530{
     531    if (checkEval(directive))
     532        return true;
     533    reportViolation(directive->text(), consoleMessage);
     534    return false;
     535}
     536
     537bool ContentSecurityPolicy::checkSourceAndReportViolation(CSPDirective* directive, const KURL& url, const String& type) const
     538{
     539    if (!directive || directive->allows(url))
     540        return true;
     541    reportViolation(directive->text(), makeString("Refused to load ", type, " from '", url.string(), "' because of Content-Security-Policy.\n"));
     542    return false;
     543}
     544
    511545bool ContentSecurityPolicy::allowJavaScriptURLs() const
    512546{
    513     if (!m_scriptSrc || m_scriptSrc->allowInline())
    514         return true;
    515 
    516547    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because of Content-Security-Policy.\n"));
    517     reportViolation(m_scriptSrc->text(), consoleMessage);
    518     return false;
     548    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
    519549}
    520550
    521551bool ContentSecurityPolicy::allowInlineEventHandlers() const
    522552{
    523     if (!m_scriptSrc || m_scriptSrc->allowInline())
    524         return true;
    525 
    526553    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline event handler because of Content-Security-Policy.\n"));
    527     reportViolation(m_scriptSrc->text(), consoleMessage);
    528     return false;
     554    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
    529555}
    530556
    531557bool ContentSecurityPolicy::allowInlineScript() const
    532558{
    533     if (!m_scriptSrc || m_scriptSrc->allowInline())
    534         return true;
    535 
    536559    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline script because of Content-Security-Policy.\n"));
    537     reportViolation(m_scriptSrc->text(), consoleMessage);
    538     return false;
     560    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
    539561}
    540562
    541563bool ContentSecurityPolicy::allowInlineStyle() const
    542564{
    543     if (!m_styleSrc || m_styleSrc->allowInline())
    544         return true;
    545 
    546565    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because of Content-Security-Policy.\n"));
    547     reportViolation(m_styleSrc->text(), consoleMessage);
    548     return false;
    549 }
    550 
    551 bool ContentSecurityPolicy::internalAllowEval() const
    552 {
    553     return !m_scriptSrc || m_scriptSrc->allowEval();
     566    return checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
    554567}
    555568
    556569bool ContentSecurityPolicy::allowEval() const
    557570{
    558     if (internalAllowEval())
    559         return true;
    560 
    561571    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate script because of Content-Security-Policy.\n"));
    562     reportViolation(m_scriptSrc->text(), consoleMessage);
    563     return false;
     572    return checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
    564573}
    565574
    566575bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
    567576{
    568     if (!m_scriptSrc || m_scriptSrc->allows(url))
    569         return true;
    570 
    571     reportViolation(m_scriptSrc->text(), makeString("Refused to load script from '", url.string(), "' because of Content-Security-Policy.\n"));
    572     return false;
     577    DEFINE_STATIC_LOCAL(String, type, ("script"));
     578    return checkSourceAndReportViolation(operativeDirective(m_scriptSrc.get()), url, type);
    573579}
    574580
    575581bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url) const
    576582{
    577     if (!m_objectSrc || m_objectSrc->allows(url))
    578         return true;
    579 
    580     reportViolation(m_objectSrc->text(), makeString("Refused to load object from '", url.string(), "' because of Content-Security-Policy.\n"));
    581     return false;
     583    DEFINE_STATIC_LOCAL(String, type, ("object"));
     584    return checkSourceAndReportViolation(operativeDirective(m_objectSrc.get()), url, type);
    582585}
    583586
    584587bool ContentSecurityPolicy::allowChildFrameFromSource(const KURL& url) const
    585588{
    586     if (!m_frameSrc || m_frameSrc->allows(url))
    587         return true;
    588 
    589     reportViolation(m_frameSrc->text(), makeString("Refused to load frame from '", url.string(), "' because of Content-Security-Policy.\n"));
    590     return false;
     589    DEFINE_STATIC_LOCAL(String, type, ("frame"));
     590    return checkSourceAndReportViolation(operativeDirective(m_frameSrc.get()), url, type);
    591591}
    592592
    593593bool ContentSecurityPolicy::allowImageFromSource(const KURL& url) const
    594594{
    595     if (!m_imgSrc || m_imgSrc->allows(url))
    596         return true;
    597 
    598     reportViolation(m_imgSrc->text(), makeString("Refused to load image from '", url.string(), "' because of Content-Security-Policy.\n"));
    599     return false;
     595    DEFINE_STATIC_LOCAL(String, type, ("image"));
     596    return checkSourceAndReportViolation(operativeDirective(m_imgSrc.get()), url, type);
    600597}
    601598
    602599bool ContentSecurityPolicy::allowStyleFromSource(const KURL& url) const
    603600{
    604     if (!m_styleSrc || m_styleSrc->allows(url))
    605         return true;
    606 
    607     reportViolation(m_styleSrc->text(), makeString("Refused to load style from '", url.string(), "' because of Content-Security-Policy.\n"));
    608     return false;
     601    DEFINE_STATIC_LOCAL(String, type, ("style"));
     602    return checkSourceAndReportViolation(operativeDirective(m_styleSrc.get()), url, type);
    609603}
    610604
    611605bool ContentSecurityPolicy::allowFontFromSource(const KURL& url) const
    612606{
    613     if (!m_fontSrc || m_fontSrc->allows(url))
    614         return true;
    615 
    616     reportViolation(m_fontSrc->text(), makeString("Refused to load font from '", url.string(), "' because of Content-Security-Policy.\n"));
    617     return false;
     607    DEFINE_STATIC_LOCAL(String, type, ("font"));
     608    return checkSourceAndReportViolation(operativeDirective(m_fontSrc.get()), url, type);
    618609}
    619610
    620611bool ContentSecurityPolicy::allowMediaFromSource(const KURL& url) const
    621612{
    622     if (!m_mediaSrc || m_mediaSrc->allows(url))
    623         return true;
    624 
    625     reportViolation(m_mediaSrc->text(), makeString("Refused to load media from '", url.string(), "' because of Content-Security-Policy.\n"));
    626     return false;
     613    DEFINE_STATIC_LOCAL(String, type, ("media"));
     614    return checkSourceAndReportViolation(operativeDirective(m_mediaSrc.get()), url, type);
    627615}
    628616
    … …  
    723711void ContentSecurityPolicy::addDirective(const String& name, const String& value)
    724712{
     713    DEFINE_STATIC_LOCAL(String, defaultSrc, ("default-src"));
    725714    DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
    726715    DEFINE_STATIC_LOCAL(String, objectSrc, ("object-src"));
    … …  
    734723    ASSERT(!name.isEmpty());
    735724
    736     if (!m_scriptSrc && equalIgnoringCase(name, scriptSrc))
     725    if (!m_defaultSrc && equalIgnoringCase(name, defaultSrc))
     726        m_defaultSrc = createCSPDirective(name, value);
     727    else if (!m_scriptSrc && equalIgnoringCase(name, scriptSrc))
    737728        m_scriptSrc = createCSPDirective(name, value);
    738729    else if (!m_objectSrc && equalIgnoringCase(name, objectSrc))

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r85388 r85451  
    7070    PassOwnPtr<CSPDirective> createCSPDirective(const String& name, const String& value);
    7171
     72    CSPDirective* operativeDirective(CSPDirective*) const;
    7273    void reportViolation(const String& directiveText, const String& consoleMessage) const;
    73     bool internalAllowEval() const;
     74    bool checkEval(CSPDirective*) const;
     75
     76    bool checkInlineAndReportViolation(CSPDirective*, const String& consoleMessage) const;
     77    bool checkEvalAndReportViolation(CSPDirective*, const String& consoleMessage) const;
     78    bool checkSourceAndReportViolation(CSPDirective*, const KURL&, const String& type) const;
    7479
    7580    bool m_havePolicy;
    7681    Document* m_document;
    7782
     83    OwnPtr<CSPDirective> m_defaultSrc;
    7884    OwnPtr<CSPDirective> m_scriptSrc;
    7985    OwnPtr<CSPDirective> m_objectSrc;
Note: See TracChangeset for help on using the changeset viewer.