Diff
Modified: trunk/LayoutTests/ChangeLog (198935 => 198936)
--- trunk/LayoutTests/ChangeLog 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/LayoutTests/ChangeLog 2016-04-01 01:54:47 UTC (rev 198936)
@@ -1,3 +1,23 @@
+2016-03-31 Daniel Bates <[email protected]>
+
+ REGRESSION (r197724): <object>/<embed> with no URL does not match source *
+ https://bugs.webkit.org/show_bug.cgi?id=156079
+ <rdar://problem/25470805>
+
+ Reviewed by Brent Fulgham.
+
+ Add tests to ensure that HTML object and embed elements are allowed by source *.
+
+ * platform/ios-simulator/TestExpectations: Skip added tests as plugins are not supported on iOS.
+ * http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html: Added.
+ * http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html: Added.
+ * http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html: Added.
+ * http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star-expected.txt: Added.
+ * http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html: Added.
+
2016-03-31 Saam barati <[email protected]>
[ES6] Disallow var assignments in for-in loops
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star-expected.txt (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star-expected.txt 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function testPluginRemovedItself()
+{
+ document.body.appendChild(document.createTextNode(document.getElementById("plugin") ? "FAIL" : "PASS"));
+}
+
+runAfterPluginLoad(testPluginRemovedItself, NotifyDone);
+</script>
+<meta http-equiv="Content-Security-Policy" content="default-src *">
+</head>
+<body>
+<embed id="plugin" type="application/x-webkit-test-netscape" cleardocumentduringnew>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star-expected.txt (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star-expected.txt 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function testPluginRemovedItself()
+{
+ document.body.appendChild(document.createTextNode(document.getElementById("plugin") ? "FAIL" : "PASS"));
+}
+
+runAfterPluginLoad(testPluginRemovedItself, NotifyDone);
+</script>
+<meta http-equiv="Content-Security-Policy" content="object-src *">
+</head>
+<body>
+<embed id="plugin" type="application/x-webkit-test-netscape" cleardocumentduringnew>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star-expected.txt (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star-expected.txt 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function testPluginRemovedItself()
+{
+ document.body.appendChild(document.createTextNode(document.getElementById("plugin") ? "FAIL" : "PASS"));
+}
+
+runAfterPluginLoad(testPluginRemovedItself, NotifyDone);
+</script>
+<meta http-equiv="Content-Security-Policy" content="default-src *">
+</head>
+<body>
+<object id="plugin" type="application/x-webkit-test-netscape" cleardocumentduringnew></object>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star-expected.txt (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star-expected.txt 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html (0 => 198936)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html 2016-04-01 01:54:47 UTC (rev 198936)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function testPluginRemovedItself()
+{
+ document.body.appendChild(document.createTextNode(document.getElementById("plugin") ? "FAIL" : "PASS"));
+}
+
+runAfterPluginLoad(testPluginRemovedItself, NotifyDone);
+</script>
+<meta http-equiv="Content-Security-Policy" content="object-src *">
+</head>
+<body>
+<object id="plugin" type="application/x-webkit-test-netscape" cleardocumentduringnew></object>
+</body>
+</html>
Modified: trunk/LayoutTests/platform/ios-simulator/TestExpectations (198935 => 198936)
--- trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-04-01 01:54:47 UTC (rev 198936)
@@ -87,10 +87,14 @@
http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html
http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html
http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html
+http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html
+http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html
http/tests/security/contentSecurityPolicy/object-src-param-code-blocked.html
http/tests/security/contentSecurityPolicy/object-src-param-movie-blocked.html
http/tests/security/contentSecurityPolicy/object-src-param-src-blocked.html
http/tests/security/contentSecurityPolicy/object-src-param-url-blocked.html
+http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html
+http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html
# Pointer-lock not supported on iOS
pointer-lock
Modified: trunk/Source/WebCore/ChangeLog (198935 => 198936)
--- trunk/Source/WebCore/ChangeLog 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/ChangeLog 2016-04-01 01:54:47 UTC (rev 198936)
@@ -1,3 +1,44 @@
+2016-03-31 Daniel Bates <[email protected]>
+
+ REGRESSION (r197724): <object>/<embed> with no URL does not match source *
+ https://bugs.webkit.org/show_bug.cgi?id=156079
+ <rdar://problem/25470805>
+
+ Reviewed by Brent Fulgham.
+
+ Fixes an issue where HTML object and embed elements that are not associated with a URL are
+ allowed to load when object-src/default-src contains source *. More generally, we allow
+ such elements to load so long as object-src/default-src is not 'none' per section object-src
+ of the Content Security Policy Level 3 spec., <http://w3c.github.io/webappsec-csp> (Editor's Draft, 29 February 2016).
+
+ Tests: http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html
+ http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html
+ http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html
+ http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html
+
+ * page/csp/ContentSecurityPolicy.cpp:
+ (WebCore::ContentSecurityPolicy::allowObjectFromSource): Modified to call violatedDirectiveInAnyPolicy() passing
+ ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes.
+ * page/csp/ContentSecurityPolicyDirectiveList.cpp:
+ (WebCore::checkSource): Modified to take argument of type ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone (defaults to false)
+ and pass it through to ContentSecurityPolicySourceListDirective.
+ (WebCore::checkFrameAncestors): Explicitly pass ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::No
+ to avoid URL from having the compiler implicitly convert it to a String and selecting override ContentSecurityPolicySourceListDirective::allows(const String&),
+ which will lead to incorrect results. We will look to make this code less error prone in <https://bugs.webkit.org/show_bug.cgi?id=156086>.
+ (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource): Modified to take argument of type
+ ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone and pass it through.
+ * page/csp/ContentSecurityPolicyDirectiveList.h:
+ * page/csp/ContentSecurityPolicySourceList.cpp:
+ (WebCore::ContentSecurityPolicySourceList::parse): Set instance variable m_isNone to true so that we can differentiate
+ a source list with value 'none' from a source list that lists one or more sources or non-none keywords.
+ * page/csp/ContentSecurityPolicySourceList.h:
+ (WebCore::ContentSecurityPolicySourceList::isNone): Added.
+ * page/csp/ContentSecurityPolicySourceListDirective.cpp:
+ (WebCore::ContentSecurityPolicySourceListDirective::allows): Modified to take argument of type ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone
+ and updated code to return true for an empty URL only if this argument is ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes and
+ the source list does not have value 'none'.
+ * page/csp/ContentSecurityPolicySourceListDirective.h:
+
2016-03-31 Saam barati <[email protected]>
Revert rewrite const as var workaround
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2016-04-01 01:54:47 UTC (rev 198936)
@@ -385,7 +385,10 @@
return true;
if (SchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol()))
return true;
- const ContentSecurityPolicyDirective* violatedDirective = violatedDirectiveInAnyPolicy(&ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource, url);
+ // As per section object-src of the Content Security Policy Level 3 spec., <http://w3c.github.io/webappsec-csp> (Editor's Draft, 29 February 2016),
+ // "If plugin content is loaded without an associated URL (perhaps an object element lacks a data attribute, but loads some default plugin based
+ // on the specified type), it MUST be blocked if object-src's value is 'none', but will otherwise be allowed".
+ const ContentSecurityPolicyDirective* violatedDirective = violatedDirectiveInAnyPolicy(&ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource, url, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes);
if (!violatedDirective)
return true;
String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::objectSrc, *violatedDirective, url, "Refused to load");
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp 2016-04-01 01:54:47 UTC (rev 198936)
@@ -61,9 +61,9 @@
return !directive || directive->allowInline();
}
-static inline bool checkSource(ContentSecurityPolicySourceListDirective* directive, const URL& url)
+static inline bool checkSource(ContentSecurityPolicySourceListDirective* directive, const URL& url, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone shouldAllowEmptyURLIfSourceListEmpty = ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::No)
{
- return !directive || directive->allows(url);
+ return !directive || directive->allows(url, shouldAllowEmptyURLIfSourceListEmpty);
}
static inline bool checkHash(ContentSecurityPolicySourceListDirective* directive, const ContentSecurityPolicyHash& hash)
@@ -81,7 +81,7 @@
if (!directive)
return true;
for (Frame* current = frame.tree().parent(); current; current = current->tree().parent()) {
- if (!directive->allows(current->document()->url()))
+ if (!directive->allows(current->document()->url(), ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::No))
return false;
}
return true;
@@ -257,12 +257,12 @@
return operativeDirective;
}
-const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource(const URL& url) const
+const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource(const URL& url, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone shouldAllowEmptyURLIfSourceListEmpty) const
{
if (url.isBlankURL())
return nullptr;
ContentSecurityPolicySourceListDirective* operativeDirective = this->operativeDirective(m_objectSrc.get());
- if (checkSource(operativeDirective, url))
+ if (checkSource(operativeDirective, url, shouldAllowEmptyURLIfSourceListEmpty))
return nullptr;
return operativeDirective;
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h 2016-04-01 01:54:47 UTC (rev 198936)
@@ -65,7 +65,7 @@
const ContentSecurityPolicyDirective* violatedDirectiveForFrameAncestor(const Frame&) const;
const ContentSecurityPolicyDirective* violatedDirectiveForImage(const URL&) const;
const ContentSecurityPolicyDirective* violatedDirectiveForMedia(const URL&) const;
- const ContentSecurityPolicyDirective* violatedDirectiveForObjectSource(const URL&) const;
+ const ContentSecurityPolicyDirective* violatedDirectiveForObjectSource(const URL&, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone) const;
const ContentSecurityPolicyDirective* violatedDirectiveForPluginType(const String& type, const String& typeAttribute) const;
const ContentSecurityPolicyDirective* violatedDirectiveForScript(const URL&) const;
const ContentSecurityPolicyDirective* violatedDirectiveForStyle(const URL&) const;
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp 2016-04-01 01:54:47 UTC (rev 198936)
@@ -119,9 +119,10 @@
void ContentSecurityPolicySourceList::parse(const String& value)
{
- // We represent 'none' as an empty m_list.
- if (isSourceListNone(value))
+ if (isSourceListNone(value)) {
+ m_isNone = true;
return;
+ }
auto characters = StringView(value).upconvertedCharacters();
parse(characters, characters + value.length());
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.h (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.h 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.h 2016-04-01 01:54:47 UTC (rev 198936)
@@ -54,6 +54,7 @@
bool allowInline() const { return m_allowInline && m_hashes.isEmpty() && m_nonces.isEmpty(); }
bool allowEval() const { return m_allowEval; }
bool allowSelf() const { return m_allowSelf; }
+ bool isNone() const { return m_isNone; }
private:
void parse(const UChar* begin, const UChar* end);
@@ -80,6 +81,7 @@
bool m_allowStar { false };
bool m_allowInline { false };
bool m_allowEval { false };
+ bool m_isNone { false };
};
} // namespace WebCore
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.cpp (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.cpp 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.cpp 2016-04-01 01:54:47 UTC (rev 198936)
@@ -40,11 +40,10 @@
m_sourceList.parse(value);
}
-bool ContentSecurityPolicySourceListDirective::allows(const URL& url)
+bool ContentSecurityPolicySourceListDirective::allows(const URL& url, ShouldAllowEmptyURLIfSourceListIsNotNone shouldAllowEmptyURLIfSourceListEmpty)
{
- // FIXME: We should investigate returning false for an empty URL.
if (url.isEmpty())
- return m_sourceList.allowSelf();
+ return shouldAllowEmptyURLIfSourceListEmpty == ShouldAllowEmptyURLIfSourceListIsNotNone::Yes && !m_sourceList.isNone();
return m_sourceList.matches(url);
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.h (198935 => 198936)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.h 2016-04-01 01:48:34 UTC (rev 198935)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.h 2016-04-01 01:54:47 UTC (rev 198936)
@@ -38,7 +38,8 @@
public:
ContentSecurityPolicySourceListDirective(const ContentSecurityPolicyDirectiveList&, const String& name, const String& value);
- bool allows(const URL&);
+ enum class ShouldAllowEmptyURLIfSourceListIsNotNone { No, Yes };
+ bool allows(const URL&, ShouldAllowEmptyURLIfSourceListIsNotNone);
bool allows(const ContentSecurityPolicyHash&) const;
bool allows(const String& nonce) const;
bool allowInline() const { return m_sourceList.allowInline(); }
