Attachment #279986 for bug #153150

View Details Raw Unified Return to Bug 153150



2016-05-27  Brent Fulgham  <bfulgham@apple.com>

        CSP: Fire 'load' events even when blocking loads via 'frame-src'.
        https://bugs.webkit.org/show_bug.cgi?id=153150
        <rdar://problem/24383162>

        Reviewed by NOBODY (OOPS!).

        Always fire a load event, even when the load is blocked by CSP rules, so that
        attackers cannot gain knowledge about the URL in the frame by blocking the
        load and waiting long enough to be sure that a 'load' event would have
        fired if the load wasn't blocked.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?view=rev&revision=165743>

        Tests: http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html

        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy):

2016-05-27  Ryan Haddad  <ryanhaddad@apple.com>

        Attempt to fix the iOS build.

Lines 98-103 void PolicyChecker::checkNavigationPolic Source/WebCore/loader/PolicyChecker.cpp_sec1
- Source/WebCore/loader/PolicyChecker.cpp +5 lines
98	}	98	}
99		99
100	if (!isAllowedByContentSecurityPolicy(request.url(), m_frame.ownerElement(), didReceiveRedirectResponse)) {	100	if (!isAllowedByContentSecurityPolicy(request.url(), m_frame.ownerElement(), didReceiveRedirectResponse)) {
		101	if (m_frame.ownerElement()) {
		102	// Fire a load event (even though we were blocked by CSP) as timing attacks would otherwise
		103	// reveal that the frame was blocked. This way, it looks like any other cross-origin page load.
		104	m_frame.ownerElement()->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
		105	}
101	function(request, 0, false);	106	function(request, 0, false);
102	return;	107	return;
103	}	108	}



2016-05-27  Brent Fulgham  <bfulgham@apple.com>

        CSP: Fire 'load' events even when blocking loads via 'frame-src'.
        https://bugs.webkit.org/show_bug.cgi?id=153150
        <rdar://problem/24383162>

        Reviewed by NOBODY (OOPS!).

        * TestExpectations: Unskip the cross-origin load test.
        * http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt: Update to match
        our message format.

2016-05-26  Brent Fulgham  <bfulgham@apple.com>

        DOM mutation methods fail to re-check validity of node insertion after removing nodes from old parent

Lines 842-848 webkit.org/b/111869 http/tests/security/ LayoutTests/TestExpectations_sec1
- LayoutTests/TestExpectations -1 lines
842	webkit.org/b/153148 http/tests/security/contentSecurityPolicy/eval-allowed-in-report-only-mode-and-sends-report.php	842	webkit.org/b/153148 http/tests/security/contentSecurityPolicy/eval-allowed-in-report-only-mode-and-sends-report.php
843	webkit.org/b/153150 http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html	843	webkit.org/b/153150 http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html
844	webkit.org/b/153150 http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html	844	webkit.org/b/153150 http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html
845	webkit.org/b/153150 http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html
846	webkit.org/b/153152 http/tests/security/contentSecurityPolicy/manifest-src-allowed.html # Needs testRunner.getManifestThen()	845	webkit.org/b/153152 http/tests/security/contentSecurityPolicy/manifest-src-allowed.html # Needs testRunner.getManifestThen()
847	webkit.org/b/153152 http/tests/security/contentSecurityPolicy/manifest-src-blocked.html # Needs testRunner.getManifestThen()	846	webkit.org/b/153152 http/tests/security/contentSecurityPolicy/manifest-src-blocked.html # Needs testRunner.getManifestThen()
848	webkit.org/b/153155 http/tests/security/contentSecurityPolicy/1.1/scripthash-basic-blocked-error-event.html	847	webkit.org/b/153155 http/tests/security/contentSecurityPolicy/1.1/scripthash-basic-blocked-error-event.html

Lines 1-5 LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt_sec1
- LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt -2 / +4 lines
1	CONSOLE MESSAGE: line 24: Refused to frame 'https://localhost:8443/security/contentSecurityPolicy/resources/alert-fail.html' because it violates the following Content Security Policy directive: "frame-src 'self' http://localhost:8080".	1	CONSOLE MESSAGE: Refused to load https://localhost:8443/security/contentSecurityPolicy/resources/alert-fail.html because it does not appear in the frame-src directive of the Content Security Policy.
2
3	ALERT: PASS	2	ALERT: PASS
4	ALERT: PASS	3	ALERT: PASS
5	IFrames blocked by CSP should generate a 'load' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS.	4	IFrames blocked by CSP should generate a 'load' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS.
Lines 13-16 PASS IFrame #3 generated a 'load' event. LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt_sec2
13	PASS successfullyParsed is true	12	PASS successfullyParsed is true
14		13
15	TEST COMPLETE	14	TEST COMPLETE
		15	PASS successfullyParsed is true
		16
		17	TEST COMPLETE
16		18

Return to Bug 153150

Lines 1-3 Source/WebCore/ChangeLog_sec1
- Source/WebCore/ChangeLog +21 lines
		1	2016-05-27 Brent Fulgham <bfulgham@apple.com>
		2
		3	CSP: Fire 'load' events even when blocking loads via 'frame-src'.
		4	https://bugs.webkit.org/show_bug.cgi?id=153150
		5	<rdar://problem/24383162>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	Always fire a load event, even when the load is blocked by CSP rules, so that
		10	attackers cannot gain knowledge about the URL in the frame by blocking the
		11	load and waiting long enough to be sure that a 'load' event would have
		12	fired if the load wasn't blocked.
		13
		14	Inspired by Blink patch:
		15	<https://src.chromium.org/viewvc/blink?view=rev&revision=165743>
		16
		17	Tests: http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html
		18
		19	* loader/PolicyChecker.cpp:
		20	(WebCore::PolicyChecker::checkNavigationPolicy):
		21
1	2016-05-27 Ryan Haddad <ryanhaddad@apple.com>	22	2016-05-27 Ryan Haddad <ryanhaddad@apple.com>
2		23
3	Attempt to fix the iOS build.	24	Attempt to fix the iOS build.

Lines 1-3 LayoutTests/ChangeLog_sec1
- LayoutTests/ChangeLog +12 lines
		1	2016-05-27 Brent Fulgham <bfulgham@apple.com>
		2
		3	CSP: Fire 'load' events even when blocking loads via 'frame-src'.
		4	https://bugs.webkit.org/show_bug.cgi?id=153150
		5	<rdar://problem/24383162>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	* TestExpectations: Unskip the cross-origin load test.
		10	* http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt: Update to match
		11	our message format.
		12
1	2016-05-26 Brent Fulgham <bfulgham@apple.com>	13	2016-05-26 Brent Fulgham <bfulgham@apple.com>
2		14
3	DOM mutation methods fail to re-check validity of node insertion after removing nodes from old parent	15	DOM mutation methods fail to re-check validity of node insertion after removing nodes from old parent