Diff
Modified: trunk/LayoutTests/ChangeLog (209788 => 209789)
--- trunk/LayoutTests/ChangeLog 2016-12-14 03:24:42 UTC (rev 209788)
+++ trunk/LayoutTests/ChangeLog 2016-12-14 04:18:11 UTC (rev 209789)
@@ -1,3 +1,22 @@
+2016-12-13 Daniel Bates <[email protected]>
+
+ CSP: ws: and wss: blocked with connect-src *
+ https://bugs.webkit.org/show_bug.cgi?id=165804
+ <rdar://problem/28563643>
+
+ Reviewed by David Kilzer.
+
+ Add tests to ensure that * matches ws: and wss:.
+
+ * http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed.html: Added.
+ * http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed.html: Added.
+ * http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed.html: Added.
+ * http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed.html: Added.
+
2016-12-13 Joseph Pecoraro <[email protected]>
REGRESSION(r204163): Web Inspector: Page crashes when Inspector tries to load insecure SourceMap
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed-expected.txt (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed-expected.txt 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,2 @@
+PASS did create WebSocket.
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed.html (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed.html 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="connect-src *">
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<pre id="console"></pre>
+<script>
+function log(message)
+{
+ document.getElementById("console").appendChild(document.createTextNode(message + "\n"));
+}
+
+try {
+ new WebSocket("wss://127.0.0.1:9323/websocket/tests/hybi/echo");
+ log("PASS did create WebSocket.");
+} catch(e) {
+ log("FAIL did not create WebSocket.");
+}
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed-expected.txt (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed-expected.txt 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,2 @@
+PASS did create WebSocket.
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed.html (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed.html 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="connect-src *">
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<pre id="console"></pre>
+<script>
+function log(message)
+{
+ document.getElementById("console").appendChild(document.createTextNode(message + "\n"));
+}
+
+try {
+ new WebSocket("ws://127.0.0.1:8880/websocket/tests/hybi/echo");
+ log("PASS did create WebSocket.");
+} catch(e) {
+ log("FAIL did not create WebSocket.");
+}
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed-expected.txt (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed-expected.txt 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,2 @@
+PASS did create WebSocket.
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed.html (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed.html 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="default-src *; script-src 'nonce-test'">
+<script nonce="test">
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<pre id="console"></pre>
+<script nonce="test">
+function log(message)
+{
+ document.getElementById("console").appendChild(document.createTextNode(message + "\n"));
+}
+
+try {
+ new WebSocket("wss://127.0.0.1:9323/websocket/tests/hybi/echo");
+ log("PASS did create WebSocket.");
+} catch(e) {
+ log("FAIL did not create WebSocket.");
+}
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed-expected.txt (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed-expected.txt 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,2 @@
+PASS did create WebSocket.
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed.html (0 => 209789)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed.html 2016-12-14 04:18:11 UTC (rev 209789)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="default-src *; script-src 'nonce-test'">
+<script nonce="test">
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<pre id="console"></pre>
+<script nonce="test">
+function log(message)
+{
+ document.getElementById("console").appendChild(document.createTextNode(message + "\n"));
+}
+
+try {
+ new WebSocket("ws://127.0.0.1:8880/websocket/tests/hybi/echo");
+ log("PASS did create WebSocket.");
+} catch(e) {
+ log("FAIL did not create WebSocket.");
+}
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (209788 => 209789)
--- trunk/Source/WebCore/ChangeLog 2016-12-14 03:24:42 UTC (rev 209788)
+++ trunk/Source/WebCore/ChangeLog 2016-12-14 04:18:11 UTC (rev 209789)
@@ -1,3 +1,23 @@
+2016-12-13 Daniel Bates <[email protected]>
+
+ CSP: ws: and wss: blocked with connect-src *
+ https://bugs.webkit.org/show_bug.cgi?id=165804
+ <rdar://problem/28563643>
+
+ Reviewed by David Kilzer.
+
+ Allow * to match ws: and wss:. This will make our behavior of * more closely conform
+ the behavior of * in the Content Security Policy Level 3 spec.,
+ <https://w3c.github.io/webappsec-csp/#match-url-to-source-_expression_> (Editor's Draft, 2 December 2016).
+
+ Tests: http/tests/security/contentSecurityPolicy/connect-src-star-secure-websocket-allowed.html
+ http/tests/security/contentSecurityPolicy/connect-src-star-websocket-allowed.html
+ http/tests/security/contentSecurityPolicy/default-src-star-secure-websocket-allowed.html
+ http/tests/security/contentSecurityPolicy/default-src-star-websocket-allowed.html
+
+ * page/csp/ContentSecurityPolicySourceList.cpp:
+ (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar):
+
2016-12-13 Dave Hyatt <[email protected]>
[CSS Parser] Make CSSFunctionValue derive from CSSValueList
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp (209788 => 209789)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp 2016-12-14 03:24:42 UTC (rev 209788)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp 2016-12-14 04:18:11 UTC (rev 209789)
@@ -123,7 +123,7 @@
// Although not allowed by the Content Security Policy Level 3 spec., we allow a data URL to match
// "img-src *" and either a data URL or blob URL to match "media-src *" for web compatibility.
- bool isAllowed = url.protocolIsInHTTPFamily() || m_policy.protocolMatchesSelf(url);
+ bool isAllowed = url.protocolIsInHTTPFamily() || url.protocolIs("ws") || url.protocolIs("wss") || m_policy.protocolMatchesSelf(url);
if (equalIgnoringASCIICase(m_directiveName, ContentSecurityPolicyDirectiveNames::imgSrc))
isAllowed |= url.protocolIsData();
else if (equalIgnoringASCIICase(m_directiveName, ContentSecurityPolicyDirectiveNames::mediaSrc))
