- Revision
- 125213
- Author
- [email protected]
- Date
- 2012-08-09 15:36:58 -0700 (Thu, 09 Aug 2012)
Log Message
Invalid Content Security Policy sources should generate console warnings.
https://bugs.webkit.org/show_bug.cgi?id=93599
Patch by Mike West <[email protected]> on 2012-08-09
Reviewed by Adam Barth.
Source/WebCore:
Given a Content Security Policy directive, we're currently correctly
ignoring sources that we can't parse: "'slef'", "http:///", etc. have
no effect on the protected resource's active policy. We're not, however
telling the developer what we're doing, which can lead to confusion.
This patch adds a console warning whenever an invalid source _expression_
is encountered while parsing a directive in order to make WebKit's
behavior more transparent to the developer.
There should be no functional change as a result of this patch: the
policy should be parsed exactly as before, it should simply be more
verbose.
Test: http/tests/security/contentSecurityPolicy/source-list-parsing-07.html
* page/ContentSecurityPolicy.cpp:
(WebCore::CSPSourceList::parse):
Two changes: First, if 'parseSource' returns false, then log a
warning to the developer's console. Second, if both the source and
host are empty, but parsing succeeded, then we know we're dealing
with either a wildcard- or keyword-source that was properly handled
inside 'parseSource', so jump to the next source.
(WebCore::CSPSourceList::parseSource):
Wildcard- and keyword-sources now return 'true'. They parsed
correctly, after all.
(WebCore::ContentSecurityPolicy::reportInvalidSourceExpression):
Log a console warning if an invalid source _expression_ is present in
a CSP directive's value.
(WebCore):
* page/ContentSecurityPolicy.h:
LayoutTests:
* http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt:
* http/tests/security/contentSecurityPolicy/source-list-parsing-02.html:
Move two invalid source tests out into 07.
* http/tests/security/contentSecurityPolicy/source-list-parsing-07-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/source-list-parsing-07.html: Added.
Many invalid source tests, all of which should generate warnings.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125212 => 125213)
--- trunk/LayoutTests/ChangeLog 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/LayoutTests/ChangeLog 2012-08-09 22:36:58 UTC (rev 125213)
@@ -1,3 +1,17 @@
+2012-08-09 Mike West <[email protected]>
+
+ Invalid Content Security Policy sources should generate console warnings.
+ https://bugs.webkit.org/show_bug.cgi?id=93599
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt:
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-02.html:
+ Move two invalid source tests out into 07.
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-07-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-07.html: Added.
+ Many invalid source tests, all of which should generate warnings.
+
2012-08-09 Csaba Osztrogonác <[email protected]>
[Qt] Unreviewed gardening, paint the bots green.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt (125212 => 125213)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt 2012-08-09 22:36:58 UTC (rev 125213)
@@ -1,9 +1,7 @@
-CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src https://127.?.0.1:*".
+These scripts should execute even though there are parse errors in the policy.
-None of these scripts should execute even though there are parse errors in the policy.
-
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
@@ -18,13 +16,3 @@
Frame: '<!--framePath //<!--frame2-->-->'
--------
PASS
-
---------
-Frame: '<!--framePath //<!--frame3-->-->'
---------
-PASS
-
---------
-Frame: '<!--framePath //<!--frame4-->-->'
---------
-PASS
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02.html (125212 => 125213)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02.html 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-02.html 2012-08-09 22:36:58 UTC (rev 125213)
@@ -4,8 +4,6 @@
<script src=''></script>
<script>
var tests = [
- ['no', 'script-src https://127.?.0.1:*', 'resources/script.js'],
- ['yes', 'script-src https://127.0.0.1:\t* ', 'resources/script.js'],
['yes', 'script-src\thttp://127.0.0.1:8000', 'resources/script.js'],
['yes', 'script-src http://127.0.0.1:8000 \t ', 'resources/script.js'],
['yes', 'script-src http://127.0.0.1:* ', 'resources/script.js']
@@ -14,5 +12,5 @@
</head>
<body _onload_="test()">
<p>
- None of these scripts should execute even though there are parse errors in the policy.
+ These scripts should execute even though there are parse errors in the policy.
</p>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07-expected.txt (0 => 125213)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07-expected.txt 2012-08-09 22:36:58 UTC (rev 125213)
@@ -0,0 +1,65 @@
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'http:/'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src http:/".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'http:/127.0.0.1'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src http:/127.0.0.1".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'http:///127.0.0.1'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src http:///127.0.0.1".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'http://127.0.0.1:/'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src http://127.0.0.1:/".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'https://127.?.0.1:*'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src https://127.?.0.1:*".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'https://127.0.0.1:'. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src https://127.0.0.1:".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''slef''. It will be ignored.
+CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src 'slef'".
+
+CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'https://127.0.0.1:'. It will be ignored.
+Invalid source expressions should log a console warning, and be ignored.
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame1-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame2-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame3-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame4-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame5-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame6-->-->'
+--------
+PASS
+
+--------
+Frame: '<!--framePath //<!--frame7-->-->'
+--------
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07.html (0 => 125213)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-07.html 2012-08-09 22:36:58 UTC (rev 125213)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=''></script>
+<script>
+var tests = [
+ ['no', 'script-src http:/', 'resources/script.js'],
+ ['no', 'script-src http:/127.0.0.1', 'resources/script.js'],
+ ['no', 'script-src http:///127.0.0.1', 'resources/script.js'],
+ ['no', 'script-src http://127.0.0.1:/', 'resources/script.js'],
+ ['no', 'script-src https://127.?.0.1:*', 'resources/script.js'],
+ ['no', 'script-src https://127.0.0.1:', 'resources/script.js'],
+ ['no', 'script-src \'slef\'', 'resources/script.js'],
+ ['yes','script-src https://127.0.0.1:\t* ', 'resources/script.js'],
+];
+</script>
+</head>
+<body _onload_="test()">
+ <p>
+ Invalid source expressions should log a console warning, and be ignored.
+ </p>
Modified: trunk/Source/WebCore/ChangeLog (125212 => 125213)
--- trunk/Source/WebCore/ChangeLog 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/Source/WebCore/ChangeLog 2012-08-09 22:36:58 UTC (rev 125213)
@@ -1,3 +1,40 @@
+2012-08-09 Mike West <[email protected]>
+
+ Invalid Content Security Policy sources should generate console warnings.
+ https://bugs.webkit.org/show_bug.cgi?id=93599
+
+ Reviewed by Adam Barth.
+
+ Given a Content Security Policy directive, we're currently correctly
+ ignoring sources that we can't parse: "'slef'", "http:///", etc. have
+ no effect on the protected resource's active policy. We're not, however
+ telling the developer what we're doing, which can lead to confusion.
+ This patch adds a console warning whenever an invalid source _expression_
+ is encountered while parsing a directive in order to make WebKit's
+ behavior more transparent to the developer.
+
+ There should be no functional change as a result of this patch: the
+ policy should be parsed exactly as before, it should simply be more
+ verbose.
+
+ Test: http/tests/security/contentSecurityPolicy/source-list-parsing-07.html
+
+ * page/ContentSecurityPolicy.cpp:
+ (WebCore::CSPSourceList::parse):
+ Two changes: First, if 'parseSource' returns false, then log a
+ warning to the developer's console. Second, if both the source and
+ host are empty, but parsing succeeded, then we know we're dealing
+ with either a wildcard- or keyword-source that was properly handled
+ inside 'parseSource', so jump to the next source.
+ (WebCore::CSPSourceList::parseSource):
+ Wildcard- and keyword-sources now return 'true'. They parsed
+ correctly, after all.
+ (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression):
+ Log a console warning if an invalid source _expression_ is present in
+ a CSP directive's value.
+ (WebCore):
+ * page/ContentSecurityPolicy.h:
+
2012-08-06 Nat Duca <[email protected]>
[chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.cpp (125212 => 125213)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-08-09 22:36:58 UTC (rev 125213)
@@ -264,12 +264,18 @@
bool portHasWildcard = false;
if (parseSource(beginSource, position, scheme, host, port, path, hostHasWildcard, portHasWildcard)) {
+ // Wildcard hosts and keyword sources ('self', 'unsafe-inline',
+ // etc.) aren't stored in m_list, but as attributes on the source
+ // list itself.
+ if (scheme.isEmpty() && host.isEmpty())
+ continue;
if (scheme.isEmpty())
scheme = m_policy->securityOrigin()->protocol();
if (!path.isEmpty())
m_policy->reportIgnoredPathComponent(m_directiveName, String(beginSource, position - beginSource), path);
m_list.append(CSPSource(scheme, host, port, hostHasWildcard, portHasWildcard));
- }
+ } else
+ m_policy->reportInvalidSourceExpression(m_directiveName, String(beginSource, position - beginSource));
ASSERT(position == end || isASCIISpace(*position));
}
@@ -288,22 +294,22 @@
if (end - begin == 1 && *begin == '*') {
addSourceStar();
- return false;
+ return true;
}
if (equalIgnoringCase("'self'", begin, end - begin)) {
addSourceSelf();
- return false;
+ return true;
}
if (equalIgnoringCase("'unsafe-inline'", begin, end - begin)) {
addSourceUnsafeInline();
- return false;
+ return true;
}
if (equalIgnoringCase("'unsafe-eval'", begin, end - begin)) {
addSourceUnsafeEval();
- return false;
+ return true;
}
const UChar* position = begin;
@@ -1310,6 +1316,12 @@
logToConsole(message);
}
+void ContentSecurityPolicy::reportInvalidSourceExpression(const String& directiveName, const String& source) const
+{
+ String message = makeString("The source list for Content Security Policy directive '", directiveName, "' contains an invalid source: '", source, "'. It will be ignored.");
+ logToConsole(message);
+}
+
void ContentSecurityPolicy::logToConsole(const String& message, const String& contextURL, const WTF::OrdinalNumber& contextLine, PassRefPtr<ScriptCallStack> callStack) const
{
m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, contextURL, contextLine.oneBasedInt(), callStack);
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.h (125212 => 125213)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.h 2012-08-09 22:24:52 UTC (rev 125212)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.h 2012-08-09 22:36:58 UTC (rev 125213)
@@ -97,8 +97,9 @@
void gatherReportURIs(DOMStringList&) const;
void reportDuplicateDirective(const String&) const;
+ void reportIgnoredPathComponent(const String& directiveName, const String& completeSource, const String& path) const;
void reportInvalidNonce(const String&) const;
- void reportIgnoredPathComponent(const String& directiveName, const String& completeSource, const String& path) const;
+ void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
void reportUnrecognizedDirective(const String&) const;
void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
