Changeset 99143 in webkit


Ignore:
Timestamp:
Nov 2, 2011 11:46:45 PM (12 years ago)
Author:
abarth@webkit.org
Message:

CSP should handle empty URLs as agreed at TPAC
​https://bugs.webkit.org/show_bug.cgi?id=71426

Reviewed by Eric Seidel.

Source/WebCore:

It was somewhat unclear how CSP should treat plugins that lacked a URL
because most of the CSP rules are URL-based. At TPAC, we decided to
treat "empty" URLs as if there were the URL of the document. That
means you can use plugins with no URL if you've included 'self' in
object-src, but you can also block them by using 'none' as your
object-src.

Tests: http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html

http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html
http/tests/security/contentSecurityPolicy/object-src-none-allowed.html
http/tests/security/contentSecurityPolicy/object-src-none-blocked.html

  • page/ContentSecurityPolicy.cpp:

(WebCore::CSPDirective::CSPDirective):
(WebCore::CSPDirective::allows):
(WebCore::ContentSecurityPolicy::createCSPDirective):

LayoutTests:

  • http/tests/security/contentSecurityPolicy/object-src-no-url-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/object-src-no-url-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html: Added.
    • Test the allow and block cases for plugins with no URL.
  • http/tests/security/contentSecurityPolicy/object-src-none-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/object-src-none-blocked.html: Added.
    • Somehow these tests got deleted from the repository. This patch just re-adds them.
Location:
trunk
Files:
6 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r99142 r99143  
     12011-11-02  Adam Barth  <abarth@webkit.org>
     2
     3        CSP should handle empty URLs as agreed at TPAC
     4        https://bugs.webkit.org/show_bug.cgi?id=71426
     5
     6        Reviewed by Eric Seidel.
     7
     8        * http/tests/security/contentSecurityPolicy/object-src-no-url-allowed-expected.txt: Added.
     9        * http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html: Added.
     10        * http/tests/security/contentSecurityPolicy/object-src-no-url-blocked-expected.txt: Added.
     11        * http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html: Added.
     12            - Test the allow and block cases for plugins with no URL.
     13        * http/tests/security/contentSecurityPolicy/object-src-none-allowed.html: Added.
     14        * http/tests/security/contentSecurityPolicy/object-src-none-blocked.html: Added.
     15            - Somehow these tests got deleted from the repository.  This patch just re-adds them.
     16
    1172011-11-02  Andrey Kosyakov  <caseq@chromium.org>
    218

  • trunk/Source/WebCore/ChangeLog

    r99138 r99143  
     12011-11-02  Adam Barth  <abarth@webkit.org>
     2
     3        CSP should handle empty URLs as agreed at TPAC
     4        https://bugs.webkit.org/show_bug.cgi?id=71426
     5
     6        Reviewed by Eric Seidel.
     7
     8        It was somewhat unclear how CSP should treat plugins that lacked a URL
     9        because most of the CSP rules are URL-based.  At TPAC, we decided to
     10        treat "empty" URLs as if there were the URL of the document.  That
     11        means you can use plugins with no URL if you've included 'self' in
     12        object-src, but you can also block them by using 'none' as your
     13        object-src.
     14
     15        Tests: http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html
     16               http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html
     17               http/tests/security/contentSecurityPolicy/object-src-none-allowed.html
     18               http/tests/security/contentSecurityPolicy/object-src-none-blocked.html
     19
     20        * page/ContentSecurityPolicy.cpp:
     21        (WebCore::CSPDirective::CSPDirective):
     22        (WebCore::CSPDirective::allows):
     23        (WebCore::ContentSecurityPolicy::createCSPDirective):
     24
    1252011-11-02  Adam Barth  <abarth@webkit.org>
    226

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r97360 r99143  
    459459class CSPDirective {
    460460public:
    461     CSPDirective(const String& name, const String& value, SecurityOrigin* origin)
    462         : m_sourceList(origin)
     461    CSPDirective(const String& name, const String& value, ScriptExecutionContext* context)
     462        : m_sourceList(context->securityOrigin())
    463463        , m_text(name + ' ' + value)
     464        , m_selfURL(context->url())
    464465    {
    465466        m_sourceList.parse(value);
    … …  
    468469    bool allows(const KURL& url)
    469470    {
    470         return m_sourceList.matches(url);
     471        return m_sourceList.matches(url.isEmpty() ? m_selfURL : url);
    471472    }
    472473
    … …  
    479480    CSPSourceList m_sourceList;
    480481    String m_text;
     482    KURL m_selfURL;
    481483};
    482484
    … …  
    760762PassOwnPtr<CSPDirective> ContentSecurityPolicy::createCSPDirective(const String& name, const String& value)
    761763{
    762     return adoptPtr(new CSPDirective(name, value, m_scriptExecutionContext->securityOrigin()));
     764    return adoptPtr(new CSPDirective(name, value, m_scriptExecutionContext));
    763765}
    764766
Note: See TracChangeset for help on using the changeset viewer.