Attachment #249304 for bug #141316

View Details Raw Unified Return to Bug 141316

| Differences between



2015-03-18  Zhuo Li  <zachli@apple.com>

        Scripts running in isolated world should not subject to a page's CSP about 'eval'.
        https://bugs.webkit.org/show_bug.cgi?id=141316.

        Reviewed by NOBODY (OOPS!).

        I added a new Content Security Policy directive, "script-src", so that we do not
        allow 'unsafe-eval' in the main world.

        Also I have to copy the whole function instead of using eval because
        eval is subject to the main world Content Security Policy now.

        * http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:
        * http/tests/security/isolatedWorld/bypass-main-world-csp.html:

2015-03-16  Hunseop Jeong  <hs85.jeong@samsung.com>

        [EFL] fast/css/outline-auto-empty-rects.html is failing 

Lines 2-7 CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resou a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt_sec1
- a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt +4 lines
2		2
3	ALERT: BLOCKED in main world	3	ALERT: BLOCKED in main world
4	ALERT: LOADED in isolated world	4	ALERT: LOADED in isolated world
		5	CONSOLE MESSAGE: line 38: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
		6
		7	ALERT: BLOCKED eval() in main world
		8	ALERT: Called eval() in isolated world
5	This test ensures that scripts run in isolated worlds aren't affected by the page's content security policy. Extensions, for example, should be able to load any resource they like.	9	This test ensures that scripts run in isolated worlds aren't affected by the page's content security policy. Extensions, for example, should be able to load any resource they like.
6		10
7		11



<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="img-src 'none'; script-src 'unsafe-inline'">
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    tests = 4;
    window.addEventListener("message", function(message) {
        tests -= 1;
        test();

            img.src = "../resources/abe.png";
        }

        function callEval(isolated) {
            try { 
                eval("true");
                alert('Called eval() in ' + (isolated ? "isolated world" : "main world"));
                window.postMessage("next", "*");
            } catch (error) {
                console.log(error);
                alert('BLOCKED eval() in ' + (isolated ? "isolated world" : "main world"));
                window.postMessage("next", "*");
            }
        }

        switch (tests) {
            case 4:
                setImgSrc(false);
                break;
            case 3:
                testRunner.evaluateScriptInIsolatedWorld(1, String(setImgSrc) + "\nsetImgSrc(true);");
                break;
            case 2:
                callEval(false);
                break;
            case 1:
                testRunner.evaluateScriptInIsolatedWorld(1, String(callEval) + "\ncallEval(true);");
                break;
            case 0:
                testRunner.notifyDone();



2015-03-18  Zhuo Li  <zachli@apple.com>

        Scripts running in isolated world should not subject to a page's CSP about 'eval'.
        https://bugs.webkit.org/show_bug.cgi?id=141316.

        Reviewed by NOBODY (OOPS!).

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::initScript):
        We should not impose the main world Content Security Policy onto the isolated world.

2015-03-16  Jer Noble  <jer.noble@apple.com>

        [Mac] Update missing image UI

Lines 253-260 JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld& world) a/Source/WebCore/bindings/js/ScriptController.cpp_sec1
- a/Source/WebCore/bindings/js/ScriptController.cpp -3 / +7 lines
253		253
254	windowShell->window()->updateDocument();	254	windowShell->window()->updateDocument();
255		255
256	if (m_frame.document())	256	if (m_frame.document()) {
257	windowShell->window()->setEvalEnabled(m_frame.document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport), m_frame.document()->contentSecurityPolicy()->evalDisabledErrorMessage());	257	bool shouldBypassMainWorldContentSecurityPolicy = !world.isNormal();
		258	if (shouldBypassMainWorldContentSecurityPolicy)
		259	windowShell->window()->setEvalEnabled(true);
		260	else
		261	windowShell->window()->setEvalEnabled(m_frame.document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport), m_frame.document()->contentSecurityPolicy()->evalDisabledErrorMessage());
		262	}
258		263
259	if (Page* page = m_frame.page()) {	264	if (Page* page = m_frame.page()) {
260	attachDebugger(windowShell, page->debugger());	265	attachDebugger(windowShell, page->debugger());
261	-

Return to Bug 141316

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +16 lines
		1	2015-03-18 Zhuo Li <zachli@apple.com>
		2
		3	Scripts running in isolated world should not subject to a page's CSP about 'eval'.
		4	https://bugs.webkit.org/show_bug.cgi?id=141316.
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	I added a new Content Security Policy directive, "script-src", so that we do not
		9	allow 'unsafe-eval' in the main world.
		10
		11	Also I have to copy the whole function instead of using eval because
		12	eval is subject to the main world Content Security Policy now.
		13
		14	* http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:
		15	* http/tests/security/isolatedWorld/bypass-main-world-csp.html:
		16
1	2015-03-16 Hunseop Jeong <hs85.jeong@samsung.com>	17	2015-03-16 Hunseop Jeong <hs85.jeong@samsung.com>
2		18
3	[EFL] fast/css/outline-auto-empty-rects.html is failing	19	[EFL] fast/css/outline-auto-empty-rects.html is failing

Lines 1-14 a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html_sec1
- a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html -4 / +22 lines
1	<!DOCTYPE html>	1	<!DOCTYPE html>
2	<html>	2	<html>
3	<head>	3	<head>
4	<meta http-equiv="Content-Security-Policy" content="img-src 'none'">	4	<meta http-equiv="Content-Security-Policy" content="img-src 'none'; script-src 'unsafe-inline'">
5	<script>	5	<script>
6	if (window.testRunner) {	6	if (window.testRunner) {
7	testRunner.dumpAsText();	7	testRunner.dumpAsText();
8	testRunner.waitUntilDone();	8	testRunner.waitUntilDone();
9	}	9	}
10		10
11	tests = 2;	11	tests = 4;
12	window.addEventListener("message", function(message) {	12	window.addEventListener("message", function(message) {
13	tests -= 1;	13	tests -= 1;
14	test();	14	test();
Lines 29-40 a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html_sec2
29	img.src = "../resources/abe.png";	29	img.src = "../resources/abe.png";
30	}	30	}
31		31
		32	function callEval(isolated) {
		33	try {
		34	eval("true");
		35	alert('Called eval() in ' + (isolated ? "isolated world" : "main world"));
		36	window.postMessage("next", "*");
		37	} catch (error) {
		38	console.log(error);
		39	alert('BLOCKED eval() in ' + (isolated ? "isolated world" : "main world"));
		40	window.postMessage("next", "*");
		41	}
		42	}
		43
32	switch (tests) {	44	switch (tests) {
33	case 2:	45	case 4:
34	setImgSrc(false);	46	setImgSrc(false);
35	break;	47	break;
		48	case 3:
		49	testRunner.evaluateScriptInIsolatedWorld(1, String(setImgSrc) + "\nsetImgSrc(true);");
		50	break;
		51	case 2:
		52	callEval(false);
		53	break;
36	case 1:	54	case 1:
37	testRunner.evaluateScriptInIsolatedWorld(1, String(eval("setImgSrc")) + "\nsetImgSrc(true);");	55	testRunner.evaluateScriptInIsolatedWorld(1, String(callEval) + "\ncallEval(true);");
38	break;	56	break;
39	case 0:	57	case 0:
40	testRunner.notifyDone();	58	testRunner.notifyDone();

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +11 lines
		1	2015-03-18 Zhuo Li <zachli@apple.com>
		2
		3	Scripts running in isolated world should not subject to a page's CSP about 'eval'.
		4	https://bugs.webkit.org/show_bug.cgi?id=141316.
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* bindings/js/ScriptController.cpp:
		9	(WebCore::ScriptController::initScript):
		10	We should not impose the main world Content Security Policy onto the isolated world.
		11
1	2015-03-16 Jer Noble <jer.noble@apple.com>	12	2015-03-16 Jer Noble <jer.noble@apple.com>
2		13
3	[Mac] Update missing image UI	14	[Mac] Update missing image UI