Diff
Modified: trunk/LayoutTests/ChangeLog (119203 => 119204)
--- trunk/LayoutTests/ChangeLog 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/LayoutTests/ChangeLog 2012-06-01 09:26:27 UTC (rev 119204)
@@ -1,3 +1,20 @@
+2012-06-01 Adam Barth <[email protected]>
+
+ sandbox directive in X-WebKit-CSP header unable to create a unique origin
+ https://bugs.webkit.org/show_bug.cgi?id=88014
+
+ Reviewed by Ryosuke Niwa.
+
+ * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html: Added.
+ * http/tests/security/contentSecurityPolicy/resources/sandbox.php: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html: Added.
+ * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control-expected.txt: Added.
+
2012-06-01 Zan Dobersek <[email protected]>
Unreviewed GTK gardening, add missing text and image baselines for
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/sandbox.php (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/sandbox.php (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/sandbox.php 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,9 @@
+<?php
+header("X-WebKit-CSP: sandbox " . $_GET["sandbox"]);
+?>
+<!DOCTYPE html>
+<p>Ready</p>
+<script>
+alert("Script executed in iframe.");
+window.secret = "I am a secret";
+</script>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control-expected.txt (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control-expected.txt 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,3 @@
+ALERT: Script executed in iframe.
+ALERT: PASS: Iframe was not in a unique origin
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<iframe src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ var frame = document.getElementsByTagName("iframe")[0];
+ var secret = frame.contentWindow.secret;
+ if (secret)
+ alert("PASS: Iframe was not in a unique origin");
+ else
+ alert("FAIL: Iframe was in a unique origin");
+};
+</script>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,5 @@
+ALERT: Script executed in iframe.
+CONSOLE MESSAGE: Unsafe _javascript_ attempt to access frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allow-scripts from frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html. Domains, protocols and ports must match.
+
+ALERT: PASS: Iframe was in a unique origin
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<iframe src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ var frame = document.getElementsByTagName("iframe")[0];
+ var secret = frame.contentWindow.secret;
+ if (secret)
+ alert("FAIL: Iframe was not in a unique origin: " + secret);
+ else
+ alert("PASS: Iframe was in a unique origin");
+};
+</script>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,2 @@
+ALERT: PASS: Iframe was not in a unique origin
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<iframe src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ var frame = document.getElementsByTagName("iframe")[0];
+ if (frame.contentDocument)
+ alert("PASS: Iframe was not in a unique origin");
+ else
+ alert("FAIL: Iframe was in a unique origin");
+};
+</script>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: Unsafe _javascript_ attempt to access frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allow-top-navigation from frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/sandbox-in-http-header.html. Domains, protocols and ports must match.
+
+ALERT: PASS: Iframe was in a unique origin
+
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html (0 => 119204)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html 2012-06-01 09:26:27 UTC (rev 119204)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<iframe src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ var frame = document.getElementsByTagName("iframe")[0];
+ if (frame.contentDocument)
+ alert("FAIL: Iframe was not in a unique origin");
+ else
+ alert("PASS: Iframe was in a unique origin");
+};
+</script>
Modified: trunk/Source/WebCore/ChangeLog (119203 => 119204)
--- trunk/Source/WebCore/ChangeLog 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/ChangeLog 2012-06-01 09:26:27 UTC (rev 119204)
@@ -1,3 +1,45 @@
+2012-06-01 Adam Barth <[email protected]>
+
+ sandbox directive in X-WebKit-CSP header unable to create a unique origin
+ https://bugs.webkit.org/show_bug.cgi?id=88014
+
+ Reviewed by Ryosuke Niwa.
+
+ We process the HTTP headers for a response after we create a document
+ object for the response. Previously, the SecurityOrigin of a document
+ was determined when the document was created, which meant that the
+ sandbox directive in CSP couldn't create a unique origin.
+
+ In this patch, we transition to a unique origin when we start enforcing
+ the SandboxOrigin bit. This patch is more complicated than you might
+ expect because we redundantly store the SecurityOrigin object in
+ DOMWindow. Removing that redundant state is
+ https://bugs.webkit.org/show_bug.cgi?id=75793.
+
+ The CSP sandbox directive is defined in
+ http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-1.0-specification.html
+ by reference to
+ http://www.whatwg.org/specs/web-apps/current-work/#forced-sandboxing-flag-set.
+ The relation between sandbox and unique origin arises from
+ http://www.whatwg.org/specs/web-apps/current-work/#origin-0.
+
+ Test: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-control.html
+ http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html
+ http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control.html
+ http/tests/security/contentSecurityPolicy/sandbox-in-http-header.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::didUpdateSecurityOrigin):
+ (WebCore::Document::initContentSecurityPolicy):
+ * dom/Document.h:
+ (Document):
+ * dom/SecurityContext.cpp:
+ (WebCore::SecurityContext::enforceSandboxFlags):
+ (WebCore):
+ (WebCore::SecurityContext::didUpdateSecurityOrigin):
+ * dom/SecurityContext.h:
+ (SecurityContext):
+
2012-05-31 Yury Semikhatsky <[email protected]>
Web Inspector: expose MemoryCache statistics in the inspector protocol
Modified: trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp (119203 => 119204)
--- trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-06-01 09:26:27 UTC (rev 119204)
@@ -592,6 +592,8 @@
void V8DOMWindowShell::updateSecurityOrigin()
{
+ if (m_context.IsEmpty())
+ return;
v8::HandleScope scope;
setSecurityToken();
}
Modified: trunk/Source/WebCore/dom/Document.cpp (119203 => 119204)
--- trunk/Source/WebCore/dom/Document.cpp 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/dom/Document.cpp 2012-06-01 09:26:27 UTC (rev 119204)
@@ -5040,9 +5040,14 @@
contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
}
-void Document::setSecurityOrigin(PassRefPtr<SecurityOrigin> origin)
+void Document::didUpdateSecurityOrigin()
{
- SecurityContext::setSecurityOrigin(origin);
+ if (!m_frame)
+ return;
+ // FIXME: We should remove DOMWindow::m_securityOrigin so that we don't need to keep them in sync.
+ // See <https://bugs.webkit.org/show_bug.cgi?id=75793>.
+ m_frame->domWindow()->setSecurityOrigin(securityOrigin());
+ m_frame->script()->updateSecurityOrigin();
}
bool Document::isContextThread() const
Modified: trunk/Source/WebCore/dom/Document.h (119203 => 119204)
--- trunk/Source/WebCore/dom/Document.h 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/dom/Document.h 2012-06-01 09:26:27 UTC (rev 119204)
@@ -1048,11 +1048,6 @@
void initSecurityContext();
void initContentSecurityPolicy();
- // Explicitly override the security origin for this document.
- // Note: It is dangerous to change the security origin of a document
- // that already contains content.
- void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
-
void updateURLForPushOrReplaceState(const KURL&);
void statePopped(PassRefPtr<SerializedScriptValue>);
@@ -1167,6 +1162,8 @@
protected:
Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
+ virtual void didUpdateSecurityOrigin() OVERRIDE;
+
void clearXMLVersion() { m_xmlVersion = String(); }
private:
Modified: trunk/Source/WebCore/dom/SecurityContext.cpp (119203 => 119204)
--- trunk/Source/WebCore/dom/SecurityContext.cpp 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/dom/SecurityContext.cpp 2012-06-01 09:26:27 UTC (rev 119204)
@@ -67,6 +67,22 @@
return securityOrigin()->canAccess(other.get());
}
+void SecurityContext::enforceSandboxFlags(SandboxFlags mask)
+{
+ m_sandboxFlags |= mask;
+
+ // The SandboxOrigin is stored redundantly in the security origin.
+ if (isSandboxed(SandboxOrigin) && securityOrigin() && !securityOrigin()->isUnique()) {
+ setSecurityOrigin(SecurityOrigin::createUnique());
+ didUpdateSecurityOrigin();
+ }
+}
+
+void SecurityContext::didUpdateSecurityOrigin()
+{
+ // Subclasses can override this function if the need to do extra work when the security origin changes.
+}
+
SandboxFlags SecurityContext::parseSandboxPolicy(const String& policy)
{
// http://www.w3.org/TR/html5/the-iframe-element.html#attr-iframe-sandbox
Modified: trunk/Source/WebCore/dom/SecurityContext.h (119203 => 119204)
--- trunk/Source/WebCore/dom/SecurityContext.h 2012-06-01 09:03:20 UTC (rev 119203)
+++ trunk/Source/WebCore/dom/SecurityContext.h 2012-06-01 09:26:27 UTC (rev 119204)
@@ -62,19 +62,22 @@
bool isSecureTransitionTo(const KURL&) const;
- void enforceSandboxFlags(SandboxFlags mask) { m_sandboxFlags |= mask; }
+ void enforceSandboxFlags(SandboxFlags mask);
bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+ // Explicitly override the security origin for this security context.
+ // Note: It is dangerous to change the security origin of a script context
+ // that already contains content.
+ void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
+
static SandboxFlags parseSandboxPolicy(const String& policy);
protected:
SecurityContext();
- ~SecurityContext();
+ virtual ~SecurityContext();
- // Explicitly override the security origin for this security context.
- // Note: It is dangerous to change the security origin of a script context
- // that already contains content.
- void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
+ virtual void didUpdateSecurityOrigin();
+
void setContentSecurityPolicy(PassOwnPtr<ContentSecurityPolicy>);
void didFailToInitializeSecurityOrigin() { m_haveInitializedSecurityOrigin = false; }
