Attachment 275413 Details for Bug 153598 – Patch

[patch] Patch

bug-153598-20160401102808.patch (text/plain), 13.45 KB, created by John Wilander on 2016-04-01 10:28:04 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: John Wilander

Created: 2016-04-01 10:28:04 PDT

Size: 13.45 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 198947)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,19 @@
>+2016-04-01  John Wilander  <wilander@apple.com>
>+
>+        CSP: Block XHR when calling XMLHttpRequest.send() and throw network error.
>+        https://bugs.webkit.org/show_bug.cgi?id=153598
>+        <rdar://problem/24391483>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Tests: http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed.html
>+               http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html
>+
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::open):
>+        (WebCore::XMLHttpRequest::initSend):
>+            - Moved the CSP check from open to initSend and changed the error type from Security to Network.
>+
> 2016-04-01  Alex Christensen  <achristensen@webkit.org>
> 
>         Compile DumpRenderTree with CMake on Mac
>Index: Source/WebCore/xml/XMLHttpRequest.cpp
>===================================================================
>--- Source/WebCore/xml/XMLHttpRequest.cpp	(revision 198917)
>+++ Source/WebCore/xml/XMLHttpRequest.cpp	(working copy)
>@@ -497,13 +497,6 @@ void XMLHttpRequest::open(const String& 
>         return;
>     }
> 
>-    // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
>-    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(url, scriptExecutionContext()->shouldBypassMainWorldContentSecurityPolicy())) {
>-        // FIXME: Should this be throwing an exception?
>-        ec = SECURITY_ERR;
>-        return;
>-    }
>-
>     if (!async && scriptExecutionContext()->isDocument()) {
>         if (document()->settings() && !document()->settings()->syncXHRInDocumentsEnabled()) {
>             logConsoleError(scriptExecutionContext(), "Synchronous XMLHttpRequests are disabled for this page.");
>@@ -573,6 +566,12 @@ bool XMLHttpRequest::initSend(ExceptionC
>     }
>     ASSERT(!m_loader);
> 
>+    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(m_url, scriptExecutionContext()->shouldBypassMainWorldContentSecurityPolicy())) {
>+        // FIXME: Should this be throwing an exception?
>+        ec = NETWORK_ERR;
>+        return false;
>+    }
>+
>     m_error = false;
>     return true;
> }
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 198917)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,28 @@
>+2016-04-01  John Wilander  <wilander@apple.com>
>+
>+        CSP: Block XHR when calling XMLHttpRequest.send() and throw network error.
>+        https://bugs.webkit.org/show_bug.cgi?id=153598
>+        <rdar://problem/24391483>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt: Removed.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html: Removed.
>+            - Old test removed.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed-expected.txt: Added.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed.html: Added.
>+            - Tests that XMLHttpRequest.open() is allowed even if the URL voilates the connect-src directive in CSP.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt: Added.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html: Added.
>+            - Tests that XMLHttpRequest.send() is blocked if the URL voilates the connect-src directive in CSP.
>+        * http/tests/security/contentSecurityPolicy/resources/worker.php:
>+            - Added two additional calls to XMLHttpRequest.send() to make existing tests work with the changes.
>+        * http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html:
>+            - Added an additional call to XMLHttpRequest.send() to make existing test work with the changes.
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt:
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html:
>+            - Added an additional call to XMLHttpRequest.send() to make existing tests work with the changes. Also entered the expected outcome since the debug output now says .send instead of .open.
>+
> 2016-03-31  Chris Dumez  <cdumez@apple.com>
> 
>         REGRESSION (r191180): Safari does not send Referer Header to iframe src in certain situations
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt	(revision 198917)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt	(working copy)
>@@ -1,3 +0,0 @@
>-CONSOLE MESSAGE: Refused to connect to http://localhost:8000/xmlhttprequest/resources/get.txt because it does not appear in the connect-src directive of the Content Security Policy.
>-Pass
>-
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html	(revision 198917)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html	(working copy)
>@@ -1,28 +0,0 @@
>-<!DOCTYPE html>
>-<html>
>-<head>
>-<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
>-<script>
>-if (window.testRunner)
>-    testRunner.dumpAsText();
>-</script>
>-</head>
>-<body>
>-<pre id="console"></pre>
>-<script>
>-function log(msg)
>-{
>-    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
>-}
>-
>-try {
>-    var xhr = new XMLHttpRequest;
>-    xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true); 
>-    log("Fail");
>-} catch(e) {
>-    log("Pass");
>-}
>-
>-</script>
>-</body>
>-</html>
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed-expected.txt	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed-expected.txt	(working copy)
>@@ -0,0 +1,2 @@
>+Pass
>+
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed.html	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-open-allowed.html	(working copy)
>@@ -0,0 +1,28 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+</script>
>+</head>
>+<body>
>+<pre id="console"></pre>
>+<script>
>+function log(msg)
>+{
>+    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
>+}
>+
>+try {
>+    var xhr = new XMLHttpRequest;
>+    xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true); 
>+    log("Pass");
>+} catch(e) {
>+    log("Fail");
>+}
>+
>+</script>
>+</body>
>+</html>
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt	(working copy)
>@@ -0,0 +1,4 @@
>+CONSOLE MESSAGE: Refused to connect to http://localhost:8000/xmlhttprequest/resources/get.txt because it does not appear in the connect-src directive of the Content Security Policy.
>+Pass
>+Pass
>+
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html	(working copy)
>@@ -0,0 +1,37 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+</script>
>+</head>
>+<body>
>+<pre id="console"></pre>
>+<script>
>+function log(msg)
>+{
>+    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
>+}
>+
>+var xhr,
>+    handler = function() {};
>+try {
>+    xhr = new XMLHttpRequest;
>+    xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.onreadystatechange = handler;
>+    xhr.withCredentials = true;
>+    log("Pass");
>+} catch(e) {
>+    log("Fail");
>+}
>+try {
>+    xhr.send();
>+    log("Fail");
>+} catch(e) {
>+    log("Pass");
>+}
>+</script>
>+</body>
>+</html>
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html	(revision 198917)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html	(working copy)
>@@ -17,7 +17,8 @@ function log(msg)
> 
> try {
>     var xhr = new XMLHttpRequest;
>-    xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true); 
>+    xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     log("Fail");
> } catch(e) {
>     log("Pass");
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php	(revision 198917)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php	(working copy)
>@@ -61,6 +61,7 @@ try {
> try {
>     var xhr = new XMLHttpRequest;
>     xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     postMessage("xhr allowed");
> } catch(e) {
>     postMessage("xhr blocked");
>@@ -118,6 +119,7 @@ onconnect = function (e) {
> try {
>     var xhr = new XMLHttpRequest;
>     xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     postMessage("xhr allowed");
> } catch(e) {
>     postMessage("xhr blocked");
>Index: LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt	(revision 198917)
>+++ LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt	(working copy)
>@@ -1,13 +1,14 @@
> CONSOLE MESSAGE: Refused to connect to http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt because it does not appear in the connect-src directive of the Content Security Policy.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
> Tests that isolated worlds can have XHRs that the page's CSP wouldn't allow.
> 
> On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
> 
> 
> XHR from main world
>-PASS: XHR.open threw an exception.
>+PASS: XHR.send threw an exception.
> XHR from isolated world
>-PASS: XHR.open did not throw an exception.
>+PASS: XHR.send did not throw an exception.
> PASS successfullyParsed is true
> 
> TEST COMPLETE
>Index: LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html
>===================================================================
>--- LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html	(revision 198917)
>+++ LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html	(working copy)
>@@ -71,15 +71,16 @@ function xhr(shouldBlock)
>     var xhr = new XMLHttpRequest();
>     try {
>         xhr.open('GET', 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt', true);
>+        xhr.send()
>         if (shouldBlock)
>-            debug('FAIL: XHR.open should have thrown an exception.');
>+            debug('FAIL: XHR.send should have thrown an exception.');
>         else
>-            debug('PASS: XHR.open did not throw an exception.');
>+            debug('PASS: XHR.send did not throw an exception.');
>     } catch (e) {
>         if (shouldBlock)
>-            debug('PASS: XHR.open threw an exception.');
>+            debug('PASS: XHR.send threw an exception.');
>         else
>-            debug('FAIL: XHR.open should not have thrown an exception.');
>+            debug('FAIL: XHR.send should not have thrown an exception.');
>     } finally {
>         window.postMessage(JSON.stringify({'type': 'test-done'}), '*');
>     }

Actions: View | Formatted Diff | Diff

Attachments on bug 153598: 275361 | 275362 | 275363 | 275365 | 275366 | 275413 | 275417 | 275431 | 275555 | 275557 | 275629 | 275928 | 275933 | 275966