Changeset 85993 in webkit

Timestamp:

May 6, 2011 7:13:06 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-05-06 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Implement "Report-Only" mode for CSP
​https://bugs.webkit.org/show_bug.cgi?id=60402

• http/tests/security/contentSecurityPolicy/report-only-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-only.html: Added.

2011-05-06 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Implement "Report-Only" mode for CSP
​https://bugs.webkit.org/show_bug.cgi?id=60402

This mode lets web sites try out CSP by getting violation reports (and
console spam) without actually changing the behavior of their web sites.

Test: http/tests/security/contentSecurityPolicy/report-only.html

• dom/Document.cpp: (WebCore::Document::processHttpEquiv):
• loader/FrameLoader.cpp: (WebCore::FrameLoader::didBeginDocument):
• page/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): (WebCore::ContentSecurityPolicy::didReceiveHeader): (WebCore::ContentSecurityPolicy::reportViolation): (WebCore::ContentSecurityPolicy::checkInlineAndReportViolation): (WebCore::ContentSecurityPolicy::checkEvalAndReportViolation): (WebCore::ContentSecurityPolicy::checkSourceAndReportViolation): (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
• page/ContentSecurityPolicy.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/report-only-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/report-only.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (1 diff)
• Source/WebCore/loader/FrameLoader.cpp (modified) (1 diff)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (8 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-05-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement "Report-Only" mode for CSP
+        https://bugs.webkit.org/show_bug.cgi?id=60402
+
+        * http/tests/security/contentSecurityPolicy/report-only-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/report-only.html: Added.
+
 2011-05-06  Kenji Imasaki  <imasaki@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement "Report-Only" mode for CSP
+        https://bugs.webkit.org/show_bug.cgi?id=60402
+
+        This mode lets web sites try out CSP by getting violation reports (and
+        console spam) without actually changing the behavior of their web sites.
+
+        Test: http/tests/security/contentSecurityPolicy/report-only.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didBeginDocument):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        (WebCore::ContentSecurityPolicy::reportViolation):
+        (WebCore::ContentSecurityPolicy::checkInlineAndReportViolation):
+        (WebCore::ContentSecurityPolicy::checkEvalAndReportViolation):
+        (WebCore::ContentSecurityPolicy::checkSourceAndReportViolation):
+        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
+        * page/ContentSecurityPolicy.h:
+
 2011-05-06  Beth Dakin  <bdakin@apple.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -2636 +2636 @@
         }
     } else if (equalIgnoringCase(equiv, "x-webkit-csp"))
-        contentSecurityPolicy()->didReceiveHeader(content);
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforcePolicy);
+    else if (equalIgnoringCase(equiv, "x-webkit-csp-report-only"))
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportOnly);
 }
 

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -720 +720 @@
         String contentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
         if (!contentSecurityPolicy.isEmpty())
-            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(contentSecurityPolicy);
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(contentSecurityPolicy, ContentSecurityPolicy::EnforcePolicy);
+
+        String reportOnlyContentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
+        if (!contentSecurityPolicy.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(reportOnlyContentSecurityPolicy, ContentSecurityPolicy::ReportOnly);
     }
 

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -455 +455 @@
     : m_havePolicy(false)
     , m_document(document)
+    , m_reportOnly(false)
     , m_disableJavaScriptURLs(false)
 {
@@ -463 +464 @@
 }
 
-void ContentSecurityPolicy::didReceiveHeader(const String& header)
+void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType type)
 {
     if (m_havePolicy)
@@ -470 +471 @@
     parse(header);
     m_havePolicy = true;
+
+    switch (type) {
+    case ReportOnly:
+        m_reportOnly = true;
+        return;
+    case EnforcePolicy:
+        ASSERT(!m_reportOnly);
+        break;
+    }
 
     if (!checkEval(operativeDirective(m_scriptSrc.get()))) {
@@ -483 +493 @@
         return;
 
-    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
+    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String());
 
     if (m_reportURLs.isEmpty())
@@ -524 +535 @@
         return true;
     reportViolation(directive->text(), consoleMessage);
-    return false;
+    return denyIfEnforcingPolicy();
 }
 
@@ -532 +543 @@
         return true;
     reportViolation(directive->text(), consoleMessage);
-    return false;
+    return denyIfEnforcingPolicy();
 }
 
@@ -540 +551 @@
         return true;
     reportViolation(directive->text(), makeString("Refused to load ", type, " from '", url.string(), "' because of Content-Security-Policy.\n"));
-    return false;
+    return denyIfEnforcingPolicy();
 }
 
@@ -548 +559 @@
     if (m_disableJavaScriptURLs) {
         reportViolation(String(), consoleMessage);
-        return false;
+        return denyIfEnforcingPolicy();
     }
     return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -44 +44 @@
     ~ContentSecurityPolicy();
 
-    void didReceiveHeader(const String&);
+    enum HeaderType {
+        ReportOnly,
+        EnforcePolicy
+    };
+
+    void didReceiveHeader(const String&, HeaderType);
 
     bool allowJavaScriptURLs() const;
@@ -78 +83 @@
     bool checkSourceAndReportViolation(CSPDirective*, const KURL&, const String& type) const;
 
+    bool denyIfEnforcingPolicy() const { return m_reportOnly; }
+
     bool m_havePolicy;
     Document* m_document;
 
+    bool m_reportOnly;
     OwnPtr<CSPDirective> m_defaultSrc;
     OwnPtr<CSPDirective> m_scriptSrc;