Attachment 158419 Details for Bug 93783 – Liberalizing.

[patch] Liberalizing.

bug-93783-20120814235814.patch (text/plain), 4.41 KB, created by Mike West on 2012-08-14 14:58:50 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mike West

Created: 2012-08-14 14:58:50 PDT

Size: 4.41 KB

patch

obsolete

>Subversion Revision: 125534
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 3c0d142a9a10f172094e412ed042892b6e82d18f..a88d72cfc42c7754328959fb6b07efb95c665dd5 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,19 @@
>+2012-08-14  Mike West  <mkwst@chromium.org>
>+
>+        Tighten up parsing the 'script-nonce' CSP directive value.
>+        https://bugs.webkit.org/show_bug.cgi?id=93783
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Currently we're accepting any non-whitespace character. This patch
>+        limits the valid characters to VCHAR minus ',' and ';', and pulls the
>+        validity check out into a named function for clarity.
>+
>+        Test: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html
>+
>+        * page/ContentSecurityPolicy.cpp:
>+        (WebCore::CSPDirectiveList::parseScriptNonce):
>+
> 2012-08-14  Yoshifumi Inoue  <yosin@chromium.org>
> 
>         [Forms] Copy Source/WebCore/html/shadow/TextControlInnerElements.{cpp,h} to SpinButtonElement.{cpp,h}
>diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
>index 335ca3075abb9835087b94db7ed58b107b7d39a4..e809d7cda04c051d0eb3e8f0965f3883b89ba4e9 100644
>--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
>+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
>@@ -61,6 +61,11 @@ bool isDirectiveValueCharacter(UChar c)
>     return isASCIISpace(c) || (c >= 0x21 && c <= 0x7e); // Whitespace + VCHAR
> }
> 
>+bool isNonceCharacter(UChar c)
>+{
>+    return (c >= 0x21 && c <= 0x7e) && c != ',' && c != ';'; // VCHAR - ',' - ';'
>+}
>+
> bool isSourceCharacter(UChar c)
> {
>     return !isASCIISpace(c);
>@@ -998,7 +1003,7 @@ void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
>         m_scriptNonce = "";
>         return;
>     }
>-    skipWhile<isNotASCIISpace>(position, end);
>+    skipWhile<isNonceCharacter>(position, end);
>     if (nonceBegin < position)
>         nonce = String(nonceBegin, position - nonceBegin);
> 
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index dc8fdc3d895158dbf24251a1332292febe528d52..c8b25361fae20d01421b31b46884b81c7d519a7f 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2012-08-14  Mike West  <mkwst@chromium.org>
>+
>+        Tighten up parsing the 'script-nonce' CSP directive value.
>+        https://bugs.webkit.org/show_bug.cgi?id=93783
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed-expected.txt: Added.
>+        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html: Added.
>+
> 2012-08-14  Philippe Normand  <pnormand@igalia.com>
> 
>         Unreviewed, GTK gardening.
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..bb8a8e3b3fe444a2e099d9bcd584851236b28f86
>--- /dev/null
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed-expected.txt
>@@ -0,0 +1,18 @@
>+All of these scripts should execute, as all the nonces are valid.
>+
>+
>+
>+--------
>+Frame: '-->'
>+--------
>+PASS
>+
>+--------
>+Frame: '-->'
>+--------
>+PASS
>+
>+--------
>+Frame: '-->'
>+--------
>+PASS
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..c726bd1ff123d9a66c19dad63dd21bef41b273a1
>--- /dev/null
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html
>@@ -0,0 +1,16 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<script src='../resources/multiple-iframe-test.js'></script>
>+<script>
>+var tests = [
>+    ['yes', 'script-src 127.0.0.1:8000; script-nonce 1/1;', 'resources/script.js', '1/1'],
>+    ['yes', 'script-src 127.0.0.1:8000; script-nonce {};', 'resources/script.js', '{}'],
>+    ['yes', 'script-src 127.0.0.1:8000; script-nonce /\\;', 'resources/script.js', '/\\'],
>+];
>+</script>
>+</head>
>+<body onload="test()">
>+  <p>
>+      All of these scripts should execute, as all the nonces are valid.
>+  </p>

Actions: View | Formatted Diff | Diff

Attachments on bug 93783: 158393 | 158398 | 158404 | 158419