Skip to content
Permalink
Browse files
REGRESSION (r196012): Subresource may be blocked by Content Security …
…Policy if it only matches 'self'

https://bugs.webkit.org/show_bug.cgi?id=156935
<rdar://problem/25351286>

Reviewed by Darin Adler.

Source/WebCore:

Fixes an issue where subresource load may be blocked by the Content Security Policy (CSP) if its URL only
matched 'self'. In particular, the load would be blocked if initiated from a document that inherited the
origin of its owner document (e.g. the document contained in <iframe src="about:blank"></iframe>).

Following r196012 we compute and cache 'self' and its protocol on instantiation of a ContentSecurityPolicy
object for use when matching a URL against it. These cached values become out-of-date if the document
subsequently inherits the origin of its owner document. Therefore matches against 'self' will fail and
CSP will block a load if its not otherwise allowed by the policy. Previously we would compute 'self' when
parsing the definition of a source list and compute the protocol for 'self' each time we tried to match a
URL against 'self'. So, 'self' would always be up-to-date with respect to the origin of the document.

Tests: http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html
       http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html

* page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Extract out logic for computing and caching
'self' and its protocol into ContentSecurityPolicy::updateSourceSelf() and make use of this function.
(WebCore::ContentSecurityPolicy::updateSourceSelf): Computes and caches 'self' and its protocol with
respect to the specified SecurityOrigin.
(WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Call ContentSecurityPolicy::updateSourceSelf()
to ensure that we have an up-to-date representation for 'self' and the protocol of 'self' which can
become out-of-date if the document inherited the origin of its owner document.
* page/csp/ContentSecurityPolicy.h:

LayoutTests:

Add tests to ensure that we match 'self' correctly in an iframe with an about:blank document.

* http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html: Added.
* http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html: Added.

Canonical link: https://commits.webkit.org/175086@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200030 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
dydz committed Apr 25, 2016
1 parent 91b3960 commit b6ca322cd9a9a3b7d041f07717e70cbdc02607bd
@@ -1,3 +1,18 @@
2016-04-25 Daniel Bates <dabates@apple.com>

REGRESSION (r196012): Subresource may be blocked by Content Security Policy if it only matches 'self'
https://bugs.webkit.org/show_bug.cgi?id=156935
<rdar://problem/25351286>

Reviewed by Darin Adler.

Add tests to ensure that we match 'self' correctly in an iframe with an about:blank document.

* http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html: Added.
* http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html: Added.

2016-04-25 Ryan Haddad <ryanhaddad@apple.com>

Marking media/video-fullscreen-restriction-removed.html as flaky on Mac
@@ -0,0 +1,7 @@
ALERT: PASS


--------
Frame: 'frame'
--------

@@ -0,0 +1,25 @@
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'">
</head>
<body>
<iframe src="about:blank" id="frame"></iframe>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpChildFramesAsText();
testRunner.waitUntilDone();
}

function appendTestScriptToDocument(contentDocument)
{
var script = contentDocument.createElement("script");
script.src = "resources/alert-pass-and-notify-done.js";
contentDocument.body.appendChild(script);
}

appendTestScriptToDocument(document.getElementById("frame").contentDocument);
</script>
</body>
</html>
@@ -0,0 +1,13 @@
<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
</head>
<body>
<iframe srcdoc='<script src="resources/alert-pass.js"></script>'></iframe>
</body>
</html>
@@ -1,3 +1,35 @@
2016-04-25 Daniel Bates <dabates@apple.com>

REGRESSION (r196012): Subresource may be blocked by Content Security Policy if it only matches 'self'
https://bugs.webkit.org/show_bug.cgi?id=156935
<rdar://problem/25351286>

Reviewed by Darin Adler.

Fixes an issue where subresource load may be blocked by the Content Security Policy (CSP) if its URL only
matched 'self'. In particular, the load would be blocked if initiated from a document that inherited the
origin of its owner document (e.g. the document contained in <iframe src="about:blank"></iframe>).

Following r196012 we compute and cache 'self' and its protocol on instantiation of a ContentSecurityPolicy
object for use when matching a URL against it. These cached values become out-of-date if the document
subsequently inherits the origin of its owner document. Therefore matches against 'self' will fail and
CSP will block a load if its not otherwise allowed by the policy. Previously we would compute 'self' when
parsing the definition of a source list and compute the protocol for 'self' each time we tried to match a
URL against 'self'. So, 'self' would always be up-to-date with respect to the origin of the document.

Tests: http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html
http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html

* page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Extract out logic for computing and caching
'self' and its protocol into ContentSecurityPolicy::updateSourceSelf() and make use of this function.
(WebCore::ContentSecurityPolicy::updateSourceSelf): Computes and caches 'self' and its protocol with
respect to the specified SecurityOrigin.
(WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Call ContentSecurityPolicy::updateSourceSelf()
to ensure that we have an up-to-date representation for 'self' and the protocol of 'self' which can
become out-of-date if the document inherited the origin of its owner document.
* page/csp/ContentSecurityPolicy.h:

2016-04-25 Youenn Fablet <youenn.fablet@crf.canon.fr>

Drop [UsePointersEvenForNonNullableObjectArguments] from TextTrack
@@ -91,17 +91,14 @@ ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext& scriptExecu
, m_sandboxFlags(SandboxNone)
{
ASSERT(scriptExecutionContext.securityOrigin());
auto& securityOrigin = *scriptExecutionContext.securityOrigin();
m_selfSourceProtocol = securityOrigin.protocol();
m_selfSource = std::make_unique<ContentSecurityPolicySource>(*this, m_selfSourceProtocol, securityOrigin.host(), securityOrigin.port(), emptyString(), false, false);
updateSourceSelf(*scriptExecutionContext.securityOrigin());
}

ContentSecurityPolicy::ContentSecurityPolicy(const SecurityOrigin& securityOrigin, const Frame* frame)
: m_frame(frame)
, m_sandboxFlags(SandboxNone)
{
m_selfSourceProtocol = securityOrigin.protocol();
m_selfSource = std::make_unique<ContentSecurityPolicySource>(*this, m_selfSourceProtocol, securityOrigin.host(), securityOrigin.port(), emptyString(), false, false);
updateSourceSelf(securityOrigin);
}

ContentSecurityPolicy::~ContentSecurityPolicy()
@@ -175,9 +172,22 @@ void ContentSecurityPolicy::didReceiveHeader(const String& header, ContentSecuri
applyPolicyToScriptExecutionContext();
}

void ContentSecurityPolicy::updateSourceSelf(const SecurityOrigin& securityOrigin)
{
m_selfSourceProtocol = securityOrigin.protocol();
m_selfSource = std::make_unique<ContentSecurityPolicySource>(*this, m_selfSourceProtocol, securityOrigin.host(), securityOrigin.port(), emptyString(), false, false);
}

void ContentSecurityPolicy::applyPolicyToScriptExecutionContext()
{
ASSERT(m_scriptExecutionContext);

// Update source self as the security origin may have changed between the time we were created and now.
// For instance, we may have been initially created for an about:blank iframe that later inherited the
// security origin of its owner document.
ASSERT(m_scriptExecutionContext->securityOrigin());
updateSourceSelf(*m_scriptExecutionContext->securityOrigin());

if (!m_lastPolicyEvalDisabledErrorMessage.isNull())
m_scriptExecutionContext->disableEval(m_lastPolicyEvalDisabledErrorMessage);
if (m_sandboxFlags != SandboxNone && is<Document>(m_scriptExecutionContext))
@@ -149,6 +149,7 @@ class ContentSecurityPolicy {

private:
void logToConsole(const String& message, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), JSC::ExecState* = nullptr) const;
void updateSourceSelf(const SecurityOrigin&);
void applyPolicyToScriptExecutionContext();

void didReceiveHeader(const String&, ContentSecurityPolicyHeaderType, ContentSecurityPolicy::PolicyFrom);

0 comments on commit b6ca322

Please sign in to comment.