- Revision
- 128042
- Author
- [email protected]
- Date
- 2012-09-10 04:07:45 -0700 (Mon, 10 Sep 2012)
Log Message
Source/WebCore: Warn authors about CSP directives ignored due to non-ASCII values.
https://bugs.webkit.org/show_bug.cgi?id=96061
Patch by Mike West <[email protected]> on 2012-09-10
Reviewed by Adam Barth.
CSP defines directive values as VCHAR minus ';' and ','. Currently, we
ignore these directives completely in CSPDirectiveList::parseDirective,
but we don't warn authors. We ought to set their expectations correctly,
and help them fix issues in their policy.
This patch adds a console warning for directives that are ignored, and
points authors to the wonderful world of percent-encoding for situations
where high-ASCII or Unicode (or whatever) characters are required.
Test: http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html
* page/ContentSecurityPolicy.cpp:
(WebCore::CSPDirectiveList::parseDirective):
Call ContentSecurityPolicy::reportInvalidDirectiveValueCharacter in
order to report ignored directives.
(WebCore::ContentSecurityPolicy::reportInvalidDirectiveValueCharacter):
(WebCore):
* page/ContentSecurityPolicy.h:
Add new error message.
LayoutTests: CSP parsing doesn't seem treat as invalid policies with a non-ASCII path
https://bugs.webkit.org/show_bug.cgi?id=96061
Patch by Mike West <[email protected]> on 2012-09-10
Reviewed by Adam Barth.
* http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js:
(testPreescapedPolicy):
(test):
(testImpl):
To test non-ASCII characters, we need to ensure that we don't encode
them when testing.
* http/tests/security/contentSecurityPolicy/source-list-parsing-04-expected.txt:
Adding a warning for the policy here that contains an invalid
character.
* http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html: Added.
Test paths with invalid characters.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (128041 => 128042)
--- trunk/LayoutTests/ChangeLog 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/LayoutTests/ChangeLog 2012-09-10 11:07:45 UTC (rev 128042)
@@ -1,5 +1,25 @@
2012-09-10 Mike West <[email protected]>
+ CSP parsing doesn't seem treat as invalid policies with a non-ASCII path
+ https://bugs.webkit.org/show_bug.cgi?id=96061
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js:
+ (testPreescapedPolicy):
+ (test):
+ (testImpl):
+ To test non-ASCII characters, we need to ensure that we don't encode
+ them when testing.
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-04-expected.txt:
+ Adding a warning for the policy here that contains an invalid
+ character.
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html: Added.
+ Test paths with invalid characters.
+
+2012-09-10 Mike West <[email protected]>
+
http/tests/security/contentSecurityPolicy/blob-urls-match-self.html fails on Windows port
https://bugs.webkit.org/show_bug.cgi?id=96133
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js (128041 => 128042)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js 2012-09-10 11:07:45 UTC (rev 128042)
@@ -4,21 +4,35 @@
testRunner.dumpChildFramesAsText();
}
+function testPreescapedPolicy() {
+ testImpl(true);
+}
+
function test() {
+ testImpl(false);
+}
+
+function testImpl(preescapedPolicy) {
if (tests.length === 0)
return finishTesting();
var baseURL = "http://127.0.0.1:8000/security/contentSecurityPolicy/";
var current = tests.shift();
var iframe = document.createElement("iframe");
+
+ var policy = current[1];
+ if (!preescapedPolicy)
+ policy = encodeURIComponent(policy);
+
+ var scriptToLoad = baseURL + encodeURIComponent(current[2]);
+ if (current[2].match(/^data:/))
+ scriptToLoad = encodeURIComponent(current[2]);
+
iframe.src = "" + "resources/echo-script-src.pl?" +
- "should_run=" + escape(current[0]) +
- "&csp=" + escape(current[1]) +
- "&q=" + (current[2].match(/^data:/) ?
- escape(current[2]) :
- baseURL + escape(current[2]));
+ "should_run=" + encodeURIComponent(current[0]) +
+ "&csp=" + policy + "&q=" + scriptToLoad;
if (current[3])
- iframe.src += "&nonce=" + escape(current[3]);
+ iframe.src += "&nonce=" + encodeURIComponent(current[3]);
iframe._onload_ = test;
document.body.appendChild(iframe);
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-04-expected.txt (128041 => 128042)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-04-expected.txt 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-04-expected.txt 2012-09-10 11:07:45 UTC (rev 128042)
@@ -1,5 +1,6 @@
CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src https: taco".
+CONSOLE MESSAGE: The value for Content Security Policy directive 'script-src' contains an invalid character: 'https: '. Non-whitespace characters outside ASCII 0x21-0x7E must be percent-encoded, as described in RFC 3986, section 2.1: http://tools.ietf.org/html/rfc3986#section-2.1.
CONSOLE MESSAGE: Refused to load the script 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js' because it violates the following Content Security Policy directive: "script-src 'none'".
None of these scripts should execute even though there are parse errors in the policy.
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt (0 => 128042)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii-expected.txt 2012-09-10 11:07:45 UTC (rev 128042)
@@ -0,0 +1,9 @@
+CONSOLE MESSAGE: The value for Content Security Policy directive 'script-src' contains an invalid character: '127.0.0.1/ßisnotSorB/'. Non-whitespace characters outside ASCII 0x21-0x7E must be percent-encoded, as described in RFC 3986, section 2.1: http://tools.ietf.org/html/rfc3986#section-2.1.
+Sources containing non-ascii characters should be ignored, and should generate warnings.
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html (0 => 128042)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html 2012-09-10 11:07:45 UTC (rev 128042)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <meta charset="utf-8">
+ <script src=''></script>
+ <script>
+ var tests = [
+ ['yes', 'script-src 127.0.0.1%2F\xDFisnotSorB%2F', 'resources/script.js'],
+ ];
+ </script>
+</head>
+<body _onload_="testPreescapedPolicy()">
+ <p>
+ Sources containing non-ascii characters should be ignored, and should
+ generate warnings.
+ </p>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (128041 => 128042)
--- trunk/Source/WebCore/ChangeLog 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/Source/WebCore/ChangeLog 2012-09-10 11:07:45 UTC (rev 128042)
@@ -1,3 +1,30 @@
+2012-09-10 Mike West <[email protected]>
+
+ Warn authors about CSP directives ignored due to non-ASCII values.
+ https://bugs.webkit.org/show_bug.cgi?id=96061
+
+ Reviewed by Adam Barth.
+
+ CSP defines directive values as VCHAR minus ';' and ','. Currently, we
+ ignore these directives completely in CSPDirectiveList::parseDirective,
+ but we don't warn authors. We ought to set their expectations correctly,
+ and help them fix issues in their policy.
+
+ This patch adds a console warning for directives that are ignored, and
+ points authors to the wonderful world of percent-encoding for situations
+ where high-ASCII or Unicode (or whatever) characters are required.
+
+ Test: http/tests/security/contentSecurityPolicy/source-list-parsing-nonascii.html
+
+ * page/ContentSecurityPolicy.cpp:
+ (WebCore::CSPDirectiveList::parseDirective):
+ Call ContentSecurityPolicy::reportInvalidDirectiveValueCharacter in
+ order to report ignored directives.
+ (WebCore::ContentSecurityPolicy::reportInvalidDirectiveValueCharacter):
+ (WebCore):
+ * page/ContentSecurityPolicy.h:
+ Add new error message.
+
2012-09-10 Carlos Garcia Campos <[email protected]>
Unreviewed. Fix make distcheck.
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.cpp (128041 => 128042)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2012-09-10 11:07:45 UTC (rev 128042)
@@ -1110,8 +1110,10 @@
const UChar* valueBegin = position;
skipWhile<isDirectiveValueCharacter>(position, end);
- if (position != end)
+ if (position != end) {
+ m_policy->reportInvalidDirectiveValueCharacter(name, String(valueBegin, end - valueBegin));
return false;
+ }
// The directive-value may be empty.
if (valueBegin == position)
@@ -1504,6 +1506,12 @@
logToConsole(message);
}
+void ContentSecurityPolicy::reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const
+{
+ String message = makeString("The value for Content Security Policy directive '", directiveName, "' contains an invalid character: '", value, "'. Non-whitespace characters outside ASCII 0x21-0x7E must be percent-encoded, as described in RFC 3986, section 2.1: http://tools.ietf.org/html/rfc3986#section-2.1.");
+ logToConsole(message);
+}
+
void ContentSecurityPolicy::reportInvalidNonce(const String& nonce) const
{
String message = makeString("Ignoring invalid Content Security Policy script nonce: '", nonce, "'.\n");
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.h (128041 => 128042)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.h 2012-09-10 11:04:17 UTC (rev 128041)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.h 2012-09-10 11:07:45 UTC (rev 128042)
@@ -100,6 +100,7 @@
void reportDuplicateDirective(const String&) const;
void reportIgnoredPathComponent(const String& directiveName, const String& completeSource, const String& path) const;
+ void reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const;
void reportInvalidNonce(const String&) const;
void reportInvalidPluginTypes(const String&) const;
void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
