Changeset 96621 in webkit


Ignore:
Timestamp:
Oct 4, 2011 11:30:32 AM (13 years ago)
Author:
weinig@apple.com
Message:

Add support for the CSP connect-src directive
​https://bugs.webkit.org/show_bug.cgi?id=69353

Reviewed by Adam Barth.

Add CSP support for XMLHttpRequest, WebSockets and EventSource.

Source/WebCore:

Tests: http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html

http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html
http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html
http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html
http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html
http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html

  • page/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowConnectFromSource):
(WebCore::ContentSecurityPolicy::addDirective):

  • page/ContentSecurityPolicy.h:

Add connect-src directive parsing and predicate.

  • page/EventSource.cpp:

(WebCore::EventSource::create):

  • websockets/WebSocket.cpp:

(WebCore::WebSocket::connect):

  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::open):
Test allowConnectFromSource when establishing a connection.

LayoutTests:

  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html: Added.
Location:
trunk
Files:
12 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r96620 r96621  
     12011-10-04  Sam Weinig  <sam@webkit.org>
     2
     3        Add support for the CSP connect-src directive
     4        https://bugs.webkit.org/show_bug.cgi?id=69353
     5
     6        Reviewed by Adam Barth.
     7
     8        Add CSP support for XMLHttpRequest, WebSockets and EventSource.
     9
     10        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed-expected.txt: Added.
     11        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html: Added.
     12        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked-expected.txt: Added.
     13        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html: Added.
     14        * http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed-expected.txt: Added.
     15        * http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html: Added.
     16        * http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked-expected.txt: Added.
     17        * http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html: Added.
     18        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed-expected.txt: Added.
     19        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html: Added.
     20        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt: Added.
     21        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html: Added.
     22
    1232011-10-03  David Hyatt  <hyatt@apple.com>
    224

  • trunk/Source/WebCore/ChangeLog

    r96620 r96621  
     12011-10-04  Sam Weinig  <sam@webkit.org>
     2
     3        Add support for the CSP connect-src directive
     4        https://bugs.webkit.org/show_bug.cgi?id=69353
     5
     6        Reviewed by Adam Barth.
     7
     8        Add CSP support for XMLHttpRequest, WebSockets and EventSource.
     9
     10        Tests: http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html
     11               http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html
     12               http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html
     13               http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html
     14               http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html
     15               http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html
     16
     17        * page/ContentSecurityPolicy.cpp:
     18        (WebCore::ContentSecurityPolicy::allowConnectFromSource):
     19        (WebCore::ContentSecurityPolicy::addDirective):
     20        * page/ContentSecurityPolicy.h:
     21        Add connect-src directive parsing and predicate.
     22
     23        * page/EventSource.cpp:
     24        (WebCore::EventSource::create):
     25        * websockets/WebSocket.cpp:
     26        (WebCore::WebSocket::connect):
     27        * xml/XMLHttpRequest.cpp:
     28        (WebCore::XMLHttpRequest::open):
     29        Test allowConnectFromSource when establishing a connection.
     30
    1312011-10-03  David Hyatt  <hyatt@apple.com>
    232

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r96550 r96621  
    645645}
    646646
     647bool ContentSecurityPolicy::allowConnectFromSource(const KURL& url) const
     648{
     649    DEFINE_STATIC_LOCAL(String, type, ("connect"));
     650    return checkSourceAndReportViolation(operativeDirective(m_connectSrc.get()), url, type);
     651}
     652
    647653// policy            = directive-list
    648654// directive-list    = [ directive *( ";" [ directive ] ) ]
    … …  
    749755    DEFINE_STATIC_LOCAL(String, fontSrc, ("font-src"));
    750756    DEFINE_STATIC_LOCAL(String, mediaSrc, ("media-src"));
     757    DEFINE_STATIC_LOCAL(String, connectSrc, ("connect-src"));
    751758    DEFINE_STATIC_LOCAL(String, reportURI, ("report-uri"));
    752759
    … …  
    769776    else if (!m_mediaSrc && equalIgnoringCase(name, mediaSrc))
    770777        m_mediaSrc = createCSPDirective(name, value);
     778    else if (!m_connectSrc && equalIgnoringCase(name, connectSrc))
     779        m_connectSrc = createCSPDirective(name, value);
    771780    else if (m_reportURLs.isEmpty() && equalIgnoringCase(name, reportURI))
    772781        parseReportURI(value);

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r96550 r96621  
    6464    bool allowFontFromSource(const KURL&) const;
    6565    bool allowMediaFromSource(const KURL&) const;
     66    bool allowConnectFromSource(const KURL&) const;
    6667
    6768private:
    … …  
    9798    OwnPtr<CSPDirective> m_fontSrc;
    9899    OwnPtr<CSPDirective> m_mediaSrc;
     100    OwnPtr<CSPDirective> m_connectSrc;
    99101    Vector<KURL> m_reportURLs;
    100102};

  • trunk/Source/WebCore/page/EventSource.cpp

    r95901 r96621  
    3535#include "EventSource.h"
    3636
    37 #include "MemoryCache.h"
     37#include "ContentSecurityPolicy.h"
    3838#include "DOMWindow.h"
    3939#include "Event.h"
    4040#include "EventException.h"
    4141#include "ExceptionCode.h"
     42#include "MemoryCache.h"
     43#include "MessageEvent.h"
    4244#include "PlatformString.h"
    43 #include "MessageEvent.h"
    4445#include "ResourceError.h"
    4546#include "ResourceRequest.h"
    … …  
    8485    // FIXME: Should support at least some cross-origin requests.
    8586    if (!context->securityOrigin()->canRequest(fullURL)) {
     87        ec = SECURITY_ERR;
     88        return 0;
     89    }
     90
     91    if (!context->contentSecurityPolicy()->allowConnectFromSource(fullURL)) {
     92        // FIXME: Should this be throwing an exception?
    8693        ec = SECURITY_ERR;
    8794        return 0;

  • trunk/Source/WebCore/websockets/WebSocket.cpp

    r95901 r96621  
    3838#include "BlobData.h"
    3939#include "CloseEvent.h"
     40#include "ContentSecurityPolicy.h"
    4041#include "DOMWindow.h"
    4142#include "Event.h"
    … …  
    194195        scriptExecutionContext()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket port " + String::number(m_url.port()) + " blocked", 0, scriptExecutionContext()->securityOrigin()->toString(), 0);
    195196        m_state = CLOSED;
     197        ec = SECURITY_ERR;
     198        return;
     199    }
     200
     201    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectFromSource(m_url)) {
     202        m_state = CLOSED;
     203
     204        // FIXME: Should this be throwing an exception?
    196205        ec = SECURITY_ERR;
    197206        return;

  • trunk/Source/WebCore/xml/XMLHttpRequest.cpp

    r94640 r96621  
    2525#include "ArrayBuffer.h"
    2626#include "Blob.h"
    27 #include "MemoryCache.h"
     27#include "ContentSecurityPolicy.h"
    2828#include "CrossOriginAccessControl.h"
    2929#include "DOMFormData.h"
    … …  
    3939#include "HTTPValidation.h"
    4040#include "InspectorInstrumentation.h"
     41#include "MemoryCache.h"
    4142#include "ResourceError.h"
    4243#include "ResourceRequest.h"
    … …  
    5253#include "XMLHttpRequestUpload.h"
    5354#include "markup.h"
     55#include <wtf/RefCountedLeakCounter.h>
     56#include <wtf/StdLibExtras.h>
     57#include <wtf/UnusedParam.h>
    5458#include <wtf/text/CString.h>
    55 #include <wtf/StdLibExtras.h>
    56 #include <wtf/RefCountedLeakCounter.h>
    57 #include <wtf/UnusedParam.h>
    5859
    5960#if USE(JSC)
    … …  
    427428    }
    428429
     430    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectFromSource(url)) {
     431        // FIXME: Should this be throwing an exception?
     432        ec = SECURITY_ERR;
     433        return;
     434    }
     435
    429436    m_method = uppercaseKnownHTTPMethod(method);
    430437
Note: See TracChangeset for help on using the changeset viewer.