Attachment 248985 Details for Bug 141316 – Patch

[patch] Patch

0001-Scripts-running-in-isolated-world-should-not-subject.patch (text/plain), 9.20 KB, created by Zach Li on 2015-03-18 16:39:21 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Zach Li

Created: 2015-03-18 16:39:21 PDT

Size: 9.20 KB

patch

obsolete

>From 4d00aca7f545615c59b6abb418c1275415747b8a Mon Sep 17 00:00:00 2001
>From: Zhuo Li <zachli@apple.com>
>Date: Wed, 18 Mar 2015 16:32:47 -0700
>Subject: [PATCH] Scripts running in isolated world should not subject to a
> page's CSP about 'eval'. https://bugs.webkit.org/show_bug.cgi?id=141316.
>
>Reviewed by NOBODY (OOPS!).
>
>Source/WebCore:
>
>* bindings/js/ScriptController.cpp:
>(WebCore::ScriptController::initScript):
>We should not impose the main world Content Security Policy onto the isolated world.
>
>LayoutTests:
>
>I added a new Content Security Policy directive, "script-src", so that we do not
>allow 'unsafe-eval' in the main world.
>
>Also I have to copy the whole function instead of using eval because
>eval is subject to the main world Content Security Policy now.
>
>* http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:
>* http/tests/security/isolatedWorld/bypass-main-world-csp.html:
>---
> LayoutTests/ChangeLog                              | 16 ++++++++
> .../bypass-main-world-csp-expected.txt             |  4 ++
> .../isolatedWorld/bypass-main-world-csp.html       | 47 ++++++++++++++++++++--
> Source/WebCore/ChangeLog                           | 11 +++++
> Source/WebCore/bindings/js/ScriptController.cpp    |  3 +-
> 5 files changed, 76 insertions(+), 5 deletions(-)
>
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 5b25452..c53a71c 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,19 @@
>+2015-03-18  Zhuo Li  <zachli@apple.com>
>+
>+        Scripts running in isolated world should not subject to a page's CSP about 'eval'.
>+        https://bugs.webkit.org/show_bug.cgi?id=141316.
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        I added a new Content Security Policy directive, "script-src", so that we do not
>+        allow 'unsafe-eval' in the main world.
>+
>+        Also I have to copy the whole function instead of using eval because
>+        eval is subject to the main world Content Security Policy now.
>+
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp.html:
>+
> 2015-03-16  Hunseop Jeong  <hs85.jeong@samsung.com>
> 
>         [EFL] fast/css/outline-auto-empty-rects.html is failing 
>diff --git a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt
>index 8e1b157..4d04b39 100644
>--- a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt
>+++ b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt
>@@ -2,6 +2,10 @@ CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resou
> 
> ALERT: BLOCKED in main world
> ALERT: LOADED in isolated world
>+CONSOLE MESSAGE: line 38: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
>+
>+ALERT: BLOCKED in main world
>+ALERT: LOADED in isolated world
> This test ensures that scripts run in isolated worlds aren't affected by the page's content security policy. Extensions, for example, should be able to load any resource they like.
> 
> 
>diff --git a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html
>index fa22ec6..5e2a828 100644
>--- a/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html
>+++ b/LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html
>@@ -1,14 +1,14 @@
> <!DOCTYPE html>
> <html>
> <head>
>-<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
>+<meta http-equiv="Content-Security-Policy" content="img-src 'none'; script-src 'unsafe-inline'">
> <script>
>     if (window.testRunner) {
>         testRunner.dumpAsText();
>         testRunner.waitUntilDone();
>     }
> 
>-    tests = 2;
>+    tests = 4;
>     window.addEventListener("message", function(message) {
>         tests -= 1;
>         test();
>@@ -29,12 +29,51 @@
>             img.src = "../resources/abe.png";
>         }
> 
>+        function createNewFunction(isolated) {
>+            try { 
>+                new Function('return true');
>+                alert('LOADED in ' + (isolated ? "isolated world" : "main world"));
>+                window.postMessage("next", "*");
>+            } catch (error) {
>+                console.log(error);
>+                alert('BLOCKED in ' + (isolated ? "isolated world" : "main world"));
>+                window.postMessage("next", "*");
>+            }
>+        }
>+
>         switch (tests) {
>-            case 2:
>+            case 4:
>                 setImgSrc(false);
>                 break;
>+            case 3:
>+                testRunner.evaluateScriptInIsolatedWorld(1, String(function setImgSrc(isolated) {
>+                                                                        var img = document.createElement('img');
>+                                                                        document.body.appendChild(img);
>+                                                                        img.onload = function () {
>+                                                                            alert('LOADED in ' + (isolated ? "isolated world" : "main world"));
>+                                                                            window.postMessage("next", "*");
>+                                                                        };
>+                                                                        img.onerror = function () {
>+                                                                            alert('BLOCKED in ' + (isolated ? "isolated world" : "main world"));
>+                                                                            window.postMessage("next", "*");
>+                                                                        };
>+                                                                        img.src = "../resources/abe.png";
>+                                                                    }) + "\nsetImgSrc(true);");
>+                break;
>+            case 2:
>+                createNewFunction(false);
>+                break;
>             case 1:
>-                testRunner.evaluateScriptInIsolatedWorld(1, String(eval("setImgSrc")) + "\nsetImgSrc(true);");
>+                testRunner.evaluateScriptInIsolatedWorld(1, String(function createNewFunction(isolated) {
>+                                                                        try { 
>+                                                                            new Function('return true');
>+                                                                            alert('LOADED in ' + (isolated ? 'isolated world' : 'main world'));
>+                                                                            window.postMessage('next', '*');
>+                                                                        } catch (error) {
>+                                                                            alert('BLOCKED in ' + (isolated ? 'isolated world' : 'main world'));
>+                                                                            window.postMessage('next', '*');
>+                                                                        }
>+                                                                    }) + "\ncreateNewFunction(true);");
>                 break;
>             case 0:
>                 testRunner.notifyDone();
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index bdc9b48..b1134c9 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,14 @@
>+2015-03-18  Zhuo Li  <zachli@apple.com>
>+
>+        Scripts running in isolated world should not subject to a page's CSP about 'eval'.
>+        https://bugs.webkit.org/show_bug.cgi?id=141316.
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * bindings/js/ScriptController.cpp:
>+        (WebCore::ScriptController::initScript):
>+        We should not impose the main world Content Security Policy onto the isolated world.
>+
> 2015-03-16  Jer Noble  <jer.noble@apple.com>
> 
>         [Mac] Update missing image UI
>diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
>index 97b80fb..dcb6fd0 100644
>--- a/Source/WebCore/bindings/js/ScriptController.cpp
>+++ b/Source/WebCore/bindings/js/ScriptController.cpp
>@@ -253,8 +253,9 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld& world)
> 
>     windowShell->window()->updateDocument();
> 
>+    bool shouldBypassMainWorldContentSecurityPolicy = !world.isNormal();
>     if (m_frame.document())
>-        windowShell->window()->setEvalEnabled(m_frame.document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport), m_frame.document()->contentSecurityPolicy()->evalDisabledErrorMessage());
>+        windowShell->window()->setEvalEnabled(shouldBypassMainWorldContentSecurityPolicy ? shouldBypassMainWorldContentSecurityPolicy : m_frame.document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport), m_frame.document()->contentSecurityPolicy()->evalDisabledErrorMessage());
> 
>     if (Page* page = m_frame.page()) {
>         attachDebugger(windowShell, page->debugger());
>-- 
>2.2.1 (Apple Git-53)
>

Actions: View | Formatted Diff | Diff

Attachments on bug 141316: 246354 | 248985 | 249304