Title: [125195] trunk
- Revision
- 125195
- Author
- [email protected]
- Date
- 2012-08-09 13:08:23 -0700 (Thu, 09 Aug 2012)
Log Message
Source/WebCore: Content Security Policy directives that begin with an invalid character should log a console warning.
https://bugs.webkit.org/show_bug.cgi?id=93622
Patch by Mike West <[email protected]> on 2012-08-09
Reviewed by Adam Barth.
CSP directives containing unrecognized characters somewhere in the
middle were caught and logged by the current algorithm. We additionally
caught the case in which the directive begins with an invalid character,
but we silently ignored it. Now we're slightly more vocal.
This change also exits 'parseDirective' early in the case where the
directive text is empty, or filled only with whitespace. There doesn't
seem to be any value in flagging that case, as it has no impact on the
way the policy would have been interpreted (that is, 'img-src *;;...'
doesn't change in meaning by ignoring the empty directive between the
semicolons).
Test: http/tests/security/contentSecurityPolicy/directive-parsing-05.html
* page/ContentSecurityPolicy.cpp:
(WebCore::CSPDirectiveList::parseDirective):
Two changes: first, we now exit early if the entire directive text
is empty (e.g. ';;;' or '; ;'); second, if the directive begins
with a character that doesn't match 'isDirectiveNameCharacter', then
we advance either to the next space, or the end of the value, and
report an unrecognized directive to the policy.
LayoutTests: Content Security Policy directives with an invalid character should log a console warning.
https://bugs.webkit.org/show_bug.cgi?id=93622
Patch by Mike West <[email protected]> on 2012-08-09
Reviewed by Adam Barth.
* http/tests/security/contentSecurityPolicy/directive-parsing-05-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/directive-parsing-05.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125194 => 125195)
--- trunk/LayoutTests/ChangeLog 2012-08-09 20:01:04 UTC (rev 125194)
+++ trunk/LayoutTests/ChangeLog 2012-08-09 20:08:23 UTC (rev 125195)
@@ -1,3 +1,13 @@
+2012-08-09 Mike West <[email protected]>
+
+ Content Security Policy directives with an invalid character should log a console warning.
+ https://bugs.webkit.org/show_bug.cgi?id=93622
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/contentSecurityPolicy/directive-parsing-05-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/directive-parsing-05.html: Added.
+
2012-08-09 Ryosuke Niwa <[email protected]>
Fix a test after r125178.
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05-expected.txt (0 => 125195)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05-expected.txt 2012-08-09 20:08:23 UTC (rev 125195)
@@ -0,0 +1,10 @@
+CONSOLE MESSAGE: Unrecognized Content-Security-Policy directive ':script-src'.
+
+Directives starting with an invalid character should be logged and ignored.
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05.html (0 => 125195)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-05.html 2012-08-09 20:08:23 UTC (rev 125195)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+}
+</script>
+</head>
+<body>
+ <p>
+ Directives starting with an invalid character should be logged and ignored.
+ </p>
+ <iframe src=""
+</body>
+</html>
+
Modified: trunk/Source/WebCore/ChangeLog (125194 => 125195)
--- trunk/Source/WebCore/ChangeLog 2012-08-09 20:01:04 UTC (rev 125194)
+++ trunk/Source/WebCore/ChangeLog 2012-08-09 20:08:23 UTC (rev 125195)
@@ -1,3 +1,32 @@
+2012-08-09 Mike West <[email protected]>
+
+ Content Security Policy directives that begin with an invalid character should log a console warning.
+ https://bugs.webkit.org/show_bug.cgi?id=93622
+
+ Reviewed by Adam Barth.
+
+ CSP directives containing unrecognized characters somewhere in the
+ middle were caught and logged by the current algorithm. We additionally
+ caught the case in which the directive begins with an invalid character,
+ but we silently ignored it. Now we're slightly more vocal.
+
+ This change also exits 'parseDirective' early in the case where the
+ directive text is empty, or filled only with whitespace. There doesn't
+ seem to be any value in flagging that case, as it has no impact on the
+ way the policy would have been interpreted (that is, 'img-src *;;...'
+ doesn't change in meaning by ignoring the empty directive between the
+ semicolons).
+
+ Test: http/tests/security/contentSecurityPolicy/directive-parsing-05.html
+
+ * page/ContentSecurityPolicy.cpp:
+ (WebCore::CSPDirectiveList::parseDirective):
+ Two changes: first, we now exit early if the entire directive text
+ is empty (e.g. ';;;' or '; ;'); second, if the directive begins
+ with a character that doesn't match 'isDirectiveNameCharacter', then
+ we advance either to the next space, or the end of the value, and
+ report an unrecognized directive to the policy.
+
2012-08-09 Shawn Singh <[email protected]>
[chromium] Pass mask scale and offset to shaders for correct masking
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.cpp (125194 => 125195)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-08-09 20:01:04 UTC (rev 125194)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-08-09 20:08:23 UTC (rev 125195)
@@ -874,12 +874,19 @@
const UChar* position = begin;
skipWhile<isASCIISpace>(position, end);
+ // Empty directive (e.g. ";;;"). Exit early.
+ if (position == end)
+ return false;
+
const UChar* nameBegin = position;
skipWhile<isDirectiveNameCharacter>(position, end);
// The directive-name must be non-empty.
- if (nameBegin == position)
+ if (nameBegin == position) {
+ skipWhile<isNotASCIISpace>(position, end);
+ m_policy->reportUnrecognizedDirective(String(nameBegin, position - nameBegin));
return false;
+ }
name = String(nameBegin, position - nameBegin);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
