Diff
Modified: trunk/LayoutTests/ChangeLog (286093 => 286094)
--- trunk/LayoutTests/ChangeLog 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/ChangeLog 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,25 @@
+2021-11-20 Carlos Garcia Campos <[email protected]>
+
+ Report the initiating url instead of the redirected one
+ https://bugs.webkit.org/show_bug.cgi?id=233037
+
+ Reviewed by Brent Fulgham.
+
+ * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
+ * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
+
2021-11-19 Arcady Goldmints-Orlov <[email protected]>
[GLIB] Update test expectations and baselines. Unreviewed test gardening.
Modified: trunk/LayoutTests/TestExpectations (286093 => 286094)
--- trunk/LayoutTests/TestExpectations 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/TestExpectations 2021-11-20 08:15:52 UTC (rev 286094)
@@ -525,7 +525,6 @@
imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-blocked-by-default.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme.html [ Skip ]
imported/w3c/web-platform-tests/cookies/domain/domain-attribute-host-with-and-without-leading-period.sub.https.html [ Skip ]
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url="" because it does not appear in the child-src directive of the Content Security Policy.
CONSOLE MESSAGE: Blocked by Content Security Policy.
CONSOLE MESSAGE: Cannot load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js due to access control checks.
This tests that the Content Security Policy of the page blocks loading a Web Worker's script from a different origin through a redirect.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,3 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the media-src directive of the Content Security Policy.
ALERT: PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the font-src directive of the Content Security Policy.
Tests that a cross-origin CSS font loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the img-src directive of the Content Security Policy.
Tests that a cross-origin image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,3 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the script-src directive of the Content Security Policy.
ALERT: PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,3 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the style-src directive of the Content Security Policy.
ALERT: PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the font-src directive of the Content Security Policy.
Tests that a SVG font-face element is blocked from loading a cross-origin external SVG font via a redirect by the Content Security Policy. This test PASSED if there is a console warning message.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the img-src directive of the Content Security Policy.
Tests that a cross-origin SVG image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,3 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the media-src directive of the Content Security Policy.
ALERT: PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,3 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the media-src directive of the Content Security Policy.
ALERT: PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url="" because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: Blocked by Content Security Policy.
This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url="" because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: Blocked by Content Security Policy.
This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt (286093 => 286094)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,2 +1,2 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
+CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url="" because it does not appear in the script-src directive of the Content Security Policy.
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (286093 => 286094)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,12 @@
+2021-11-20 Carlos Garcia Campos <[email protected]>
+
+ Report the initiating url instead of the redirected one
+ https://bugs.webkit.org/show_bug.cgi?id=233037
+
+ Reviewed by Brent Fulgham.
+
+ * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
+
2021-11-19 Arcady Goldmints-Orlov <[email protected]>
[GLIB] Update test expectations and baselines. Unreviewed test gardening.
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt (286093 => 286094)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,4 +1,4 @@
-
-FAIL The blocked URI in the security policy violation event should be the original URI before redirects. assert_equals: expected "http://localhost:8800/common/redirect.py?location=http%3A%2F%2F127.0.0.1%3A8800%2Fcontent-security-policy%2Fsupport%2Ffail.png" but got "http://127.0.0.1:8800"
+PASS The blocked URI in the security policy violation event should be the original URI before redirects.
+
Modified: trunk/Source/WebCore/ChangeLog (286093 => 286094)
--- trunk/Source/WebCore/ChangeLog 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/ChangeLog 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,31 @@
+2021-11-20 Carlos Garcia Campos <[email protected]>
+
+ Report the initiating url instead of the redirected one
+ https://bugs.webkit.org/show_bug.cgi?id=233037
+
+ Reviewed by Brent Fulgham.
+
+ As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
+
+ * loader/DocumentThreadableLoader.cpp:
+ (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
+ * loader/SubresourceLoader.cpp:
+ (WebCore::SubresourceLoader::willSendRequestInternal):
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
+ (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
+ (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
+ * loader/cache/CachedResourceLoader.h:
+ * page/csp/ContentSecurityPolicy.cpp:
+ (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
+ (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
+ (WebCore::ContentSecurityPolicy::allowImageFromSource const):
+ (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
+ (WebCore::ContentSecurityPolicy::allowFontFromSource const):
+ (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
+ (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
+ * page/csp/ContentSecurityPolicy.h:
+
2021-11-19 Carlos Garcia Campos <[email protected]>
[GTK][a11y] Add implementation of image interface when building with ATSPI
Modified: trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp (286093 => 286094)
--- trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp 2021-11-20 08:15:52 UTC (rev 286094)
@@ -681,11 +681,11 @@
case ContentSecurityPolicyEnforcement::DoNotEnforce:
return true;
case ContentSecurityPolicyEnforcement::EnforceChildSrcDirective:
- return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
+ return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived, preRedirectURL);
case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
- return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);
+ return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL);
}
ASSERT_NOT_REACHED();
return false;
Modified: trunk/Source/WebCore/loader/SubresourceLoader.cpp (286093 => 286094)
--- trunk/Source/WebCore/loader/SubresourceLoader.cpp 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/loader/SubresourceLoader.cpp 2021-11-20 08:15:52 UTC (rev 286094)
@@ -277,7 +277,7 @@
m_frame->page()->diagnosticLoggingClient().logDiagnosticMessageWithResult(DiagnosticLoggingKeys::cachedResourceRevalidationKey(), emptyString(), DiagnosticLoggingResultFail, ShouldSample::Yes);
}
- if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options())) {
+ if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options(), redirectResponse.url())) {
SUBRESOURCELOADER_RELEASE_LOG("willSendRequestInternal: resource load canceled because CachedResourceLoader::updateRequestAfterRedirection (really CachedResourceLoader::canRequestAfterRedirection) said no");
cancel();
return completionHandler(WTFMove(newRequest));
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (286093 => 286094)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2021-11-20 08:15:52 UTC (rev 286094)
@@ -488,7 +488,7 @@
return true;
}
-bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived) const
+bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
if (options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck)
return true;
@@ -501,22 +501,22 @@
case CachedResource::Type::XSLStyleSheet:
#endif
case CachedResource::Type::Script:
- if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
case CachedResource::Type::CSSStyleSheet:
- if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
case CachedResource::Type::SVGDocumentResource:
case CachedResource::Type::Icon:
case CachedResource::Type::ImageResource:
- if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
case CachedResource::Type::SVGFontResource:
case CachedResource::Type::FontResource:
- if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
case CachedResource::Type::MediaResource:
@@ -523,7 +523,7 @@
#if ENABLE(VIDEO)
case CachedResource::Type::TextTrackResource:
#endif
- if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
case CachedResource::Type::Beacon:
@@ -535,7 +535,7 @@
return true;
#if ENABLE(APPLICATION_MANIFEST)
case CachedResource::Type::ApplicationManifest:
- if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived))
+ if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived, preRedirectURL))
return false;
break;
#endif
@@ -593,7 +593,7 @@
}
// FIXME: Should we find a way to know whether the redirection is for a preload request like we do for CachedResourceLoader::canRequest?
-bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options) const
+bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, const URL& preRedirectURL) const
{
if (document() && !document()->securityOrigin().canDisplay(url)) {
FrameLoader::reportLocalLoadFailed(frame(), url.stringCenterEllipsizedToLength());
@@ -611,7 +611,7 @@
return false;
}
- if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
+ if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes, preRedirectURL)) {
CACHEDRESOURCELOADER_RELEASE_LOG("canRequestAfterRedirection: URL was not allowed by content policy");
return false;
}
@@ -626,7 +626,7 @@
return true;
}
-bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options)
+bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options, const URL& preRedirectURL)
{
ASSERT(m_documentLoader);
if (auto* document = m_documentLoader->cachedResourceLoader().document())
@@ -634,7 +634,7 @@
// FIXME: We might want to align the checks done here with the ones done in CachedResourceLoader::requestResource, content extensions blocking in particular.
- return canRequestAfterRedirection(type, request.url(), options);
+ return canRequestAfterRedirection(type, request.url(), options, preRedirectURL);
}
bool CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox(CachedResource::Type type, const URL& url) const
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.h (286093 => 286094)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.h 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.h 2021-11-20 08:15:52 UTC (rev 286094)
@@ -156,8 +156,8 @@
void warnUnusedPreloads();
void stopUnusedPreloadsTimer();
- bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&);
- bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived) const;
+ bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&, const URL& preRedirectURL);
+ bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL()) const;
static const ResourceLoaderOptions& defaultCachedResourceOptions();
@@ -197,7 +197,7 @@
ImageLoading clientDefersImage(const URL&) const;
void reloadImagesIfNotDeferred();
- bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&) const;
+ bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&, const URL& preRedirectURL) const;
bool canRequestInContentDispositionAttachmentSandbox(CachedResource::Type, const URL&) const;
HashSet<String> m_validatedURLs;
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp (286093 => 286094)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2021-11-20 08:15:52 UTC (rev 286094)
@@ -635,44 +635,44 @@
return allPoliciesAllow(WTFMove(handleViolatedDirective), resourcePredicate, url, redirectResponseReceived == RedirectResponseReceived::Yes);
}
-bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext, preRedirectURL);
}
-bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
if (shouldPerformEarlyCSPCheck())
return true;
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, preRedirectURL);
}
-bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage, preRedirectURL);
}
-bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, preRedirectURL);
}
-bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont, preRedirectURL);
}
#if ENABLE(APPLICATION_MANIFEST)
-bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest, preRedirectURL);
}
#endif // ENABLE(APPLICATION_MANIFEST)
-bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
+bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
{
- return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia);
+ return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia, preRedirectURL);
}
bool ContentSecurityPolicy::allowConnectToSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h (286093 => 286094)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2021-11-20 08:15:52 UTC (rev 286094)
@@ -109,17 +109,17 @@
WEBCORE_EXPORT bool overridesXFrameOptions() const;
enum class RedirectResponseReceived { No, Yes };
- WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
- bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
- bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
- bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
+ WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
+ bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
+ bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
+ bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
#if ENABLE(APPLICATION_MANIFEST)
- bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
+ bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
#endif
- bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
+ bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
- WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
+ WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
Modified: trunk/Source/WebKit/ChangeLog (286093 => 286094)
--- trunk/Source/WebKit/ChangeLog 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebKit/ChangeLog 2021-11-20 08:15:52 UTC (rev 286094)
@@ -1,3 +1,15 @@
+2021-11-20 Carlos Garcia Campos <[email protected]>
+
+ Report the initiating url instead of the redirected one
+ https://bugs.webkit.org/show_bug.cgi?id=233037
+
+ Reviewed by Brent Fulgham.
+
+ Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
+
+ * NetworkProcess/NetworkLoadChecker.cpp:
+ (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
+
2021-11-19 Myles C. Maxfield <[email protected]>
[WebGPU] Implement GPU process's message receivers
Modified: trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp (286093 => 286094)
--- trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp 2021-11-20 07:52:57 UTC (rev 286093)
+++ trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp 2021-11-20 08:15:52 UTC (rev 286094)
@@ -290,9 +290,9 @@
case FetchOptions::Destination::Worker:
case FetchOptions::Destination::Serviceworker:
case FetchOptions::Destination::Sharedworker:
- return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived);
+ return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived, preRedirectURL);
case FetchOptions::Destination::Script:
- if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived))
+ if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived, preRedirectURL))
return false;
// FIXME: Check CSP for non-importScripts() initiated loads.
return true;
