- Revision
- 144566
- Author
- [email protected]
- Date
- 2013-03-03 01:28:53 -0800 (Sun, 03 Mar 2013)
Log Message
CSP: Throw a warning when a '*-report-only' header doesn't contain a 'report-uri' directive.
https://bugs.webkit.org/show_bug.cgi?id=111208
Reviewed by Adam Barth.
Source/WebCore:
Developers in the wild have been observed to serve a report-only CSP
header with a policy that doesn't contain a 'report-uri' directive.
This has zero effect, of course, and we should help them understand
that by throwing a warning up on the console.
Test: http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html
* page/ContentSecurityPolicy.cpp:
(WebCore::CSPDirectiveList::isReportOnly): Added.
(WebCore::CSPDirectiveList::reportURIs): Added.
(WebCore::CSPDirectiveList::create):
After creating a CSPDirectiveList, check whether it's in
report-only mode without a report-uri. If so, warn the developer.
(WebCore::ContentSecurityPolicy::reportMissingReportURI): Added.
Write an exciting message to the console, warning the developer
about her expensive no-op machine.
LayoutTests:
* http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (144565 => 144566)
--- trunk/LayoutTests/ChangeLog 2013-03-03 09:16:26 UTC (rev 144565)
+++ trunk/LayoutTests/ChangeLog 2013-03-03 09:28:53 UTC (rev 144566)
@@ -1,3 +1,13 @@
+2013-03-03 Mike West <[email protected]>
+
+ CSP: Throw a warning when a '*-report-only' header doesn't contain a 'report-uri' directive.
+ https://bugs.webkit.org/show_bug.cgi?id=111208
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html: Added.
+
2013-03-02 Zan Dobersek <[email protected]>
REGRESSION (r144517): IndexedDB layout test failures on GTK
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt (0 => 144566)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing-expected.txt 2013-03-03 09:28:53 UTC (rev 144566)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: The Content Security Policy 'script-src 'unsafe-inline';' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
+This test passes if a console message is present, warning about the missing 'report-uri' directive.
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html (0 => 144566)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html 2013-03-03 09:28:53 UTC (rev 144566)
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <meta http-equiv="Content-Security-Policy-Report-Only" content="script-src 'unsafe-inline';">
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</head>
+<body>
+ <p>This test passes if a console message is present, warning about the missing 'report-uri' directive.</p>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (144565 => 144566)
--- trunk/Source/WebCore/ChangeLog 2013-03-03 09:16:26 UTC (rev 144565)
+++ trunk/Source/WebCore/ChangeLog 2013-03-03 09:28:53 UTC (rev 144566)
@@ -1,3 +1,27 @@
+2013-03-03 Mike West <[email protected]>
+
+ CSP: Throw a warning when a '*-report-only' header doesn't contain a 'report-uri' directive.
+ https://bugs.webkit.org/show_bug.cgi?id=111208
+
+ Reviewed by Adam Barth.
+
+ Developers in the wild have been observed to serve a report-only CSP
+ header with a policy that doesn't contain a 'report-uri' directive.
+ This has zero effect, of course, and we should help them understand
+ that by throwing a warning up on the console.
+
+ Test: http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.html
+
+ * page/ContentSecurityPolicy.cpp:
+ (WebCore::CSPDirectiveList::isReportOnly): Added.
+ (WebCore::CSPDirectiveList::reportURIs): Added.
+ (WebCore::CSPDirectiveList::create):
+ After creating a CSPDirectiveList, check whether it's in
+ report-only mode without a report-uri. If so, warn the developer.
+ (WebCore::ContentSecurityPolicy::reportMissingReportURI): Added.
+ Write an exciting message to the console, warning the developer
+ about her expensive no-op machine.
+
2013-03-03 Adam Barth <[email protected]>
Unreviewed rollout of http://trac.webkit.org/r144530
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.cpp (144565 => 144566)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2013-03-03 09:16:26 UTC (rev 144565)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2013-03-03 09:28:53 UTC (rev 144566)
@@ -842,6 +842,8 @@
void gatherReportURIs(DOMStringList&) const;
const String& evalDisabledErrorMessage() { return m_evalDisabledErrorMessage; }
ContentSecurityPolicy::ReflectedXSSDisposition reflectedXSSDisposition() const { return m_reflectedXSSDisposition; }
+ bool isReportOnly() const { return m_reportOnly; }
+ const Vector<KURL>& reportURIs() const { return m_reportURIs; }
private:
CSPDirectiveList(ContentSecurityPolicy*, ContentSecurityPolicy::HeaderType);
@@ -929,6 +931,9 @@
directives->setEvalDisabledErrorMessage(message);
}
+ if (directives->isReportOnly() && directives->reportURIs().isEmpty())
+ policy->reportMissingReportURI(header);
+
return directives.release();
}
@@ -1804,6 +1809,11 @@
logToConsole(message);
}
+void ContentSecurityPolicy::reportMissingReportURI(const String& policy) const
+{
+ logToConsole("The Content Security Policy '" + policy + "' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.");
+}
+
void ContentSecurityPolicy::logToConsole(const String& message, const String& contextURL, const WTF::OrdinalNumber& contextLine, ScriptState* state) const
{
m_scriptExecutionContext->addConsoleMessage(JSMessageSource, ErrorMessageLevel, message, contextURL, contextLine.oneBasedInt(), state);
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.h (144565 => 144566)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.h 2013-03-03 09:16:26 UTC (rev 144565)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.h 2013-03-03 09:28:53 UTC (rev 144566)
@@ -121,6 +121,7 @@
void reportInvalidSandboxFlags(const String&) const;
void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
void reportInvalidReflectedXSS(const String&) const;
+ void reportMissingReportURI(const String&) const;
void reportUnsupportedDirective(const String&) const;
void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;
