Attachment 275557 Details for Bug 153598 – Patch

[patch] Patch

bug-153598-20160404101312.patch (text/plain), 14.23 KB, created by John Wilander on 2016-04-04 10:13:07 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: John Wilander

Created: 2016-04-04 10:13:07 PDT

Size: 14.23 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 199007)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,20 @@
>+2016-04-04  John Wilander  <wilander@apple.com>
>+
>+        CSP: Block XHR when calling XMLHttpRequest.send() and throw network error.
>+        https://bugs.webkit.org/show_bug.cgi?id=153598
>+        <rdar://problem/24391483>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Test: http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html
>+
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::open):
>+        (WebCore::XMLHttpRequest::initSend):
>+            Moved the CSP check from XMLHttpRequest::open() to XMLHttpRequest::initSend() and changed the error type from Security to Network.
>+            These changes are in conformance with connect-src of the Content Security Policy Level 2.
>+            https://www.w3.org/TR/CSP2/#directive-connect-src (W3C Candidate Recommendation, 21 July 2015)
>+
> 2016-04-04  Alejandro G. Castro  <alex@igalia.com>
> 
>         REGRESSION(r198492): [GTK] The WEB_RTC flag was not correctly added in some situations
>Index: Source/WebCore/xml/XMLHttpRequest.cpp
>===================================================================
>--- Source/WebCore/xml/XMLHttpRequest.cpp	(revision 199007)
>+++ Source/WebCore/xml/XMLHttpRequest.cpp	(working copy)
>@@ -497,13 +497,6 @@ void XMLHttpRequest::open(const String& 
>         return;
>     }
> 
>-    // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
>-    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(url, scriptExecutionContext()->shouldBypassMainWorldContentSecurityPolicy())) {
>-        // FIXME: Should this be throwing an exception?
>-        ec = SECURITY_ERR;
>-        return;
>-    }
>-
>     if (!async && scriptExecutionContext()->isDocument()) {
>         if (document()->settings() && !document()->settings()->syncXHRInDocumentsEnabled()) {
>             logConsoleError(scriptExecutionContext(), "Synchronous XMLHttpRequests are disabled for this page.");
>@@ -573,6 +566,12 @@ bool XMLHttpRequest::initSend(ExceptionC
>     }
>     ASSERT(!m_loader);
> 
>+    // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
>+    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(m_url, scriptExecutionContext()->shouldBypassMainWorldContentSecurityPolicy())) {
>+        ec = NETWORK_ERR;
>+        return false;
>+    }
>+
>     m_error = false;
>     return true;
> }
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 199007)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,30 @@
>+2016-04-04  John Wilander  <wilander@apple.com>
>+
>+        CSP: Block XHR when calling XMLHttpRequest.send() and throw network error.
>+        https://bugs.webkit.org/show_bug.cgi?id=153598
>+        <rdar://problem/24391483>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/workers/resources/worker-inherits-csp-blocks-xhr.js:
>+        (catch):
>+        * fast/workers/worker-inherits-csp-blocks-xhr-expected.txt:
>+            Changed expected error from DOMException.SECURITY_ERR to DOMException.NETWORK_ERR.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt: Removed.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html: Removed.
>+            Old test removed.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt: Added.
>+        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html: Added.
>+            Tests that XMLHttpRequest.send() is blocked if the URL voilates the connect-src directive in CSP.
>+        * http/tests/security/contentSecurityPolicy/resources/worker.php:
>+            Added two additional calls to XMLHttpRequest.send() to make existing tests work with the changes.
>+        * http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html:
>+            Added an additional call to XMLHttpRequest.send() to make existing test work with the changes.
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt:
>+        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html:
>+            Added an additional call to XMLHttpRequest.send() to make existing tests work with the changes.
>+            Also changed the expected outcome since the debug output now says .send instead of .open.
>+
> 2016-04-04  Frederic Wang  <fwang@igalia.com>
> 
>         Refactor RenderMathMLRow layout functions to avoid using flexbox
>Index: LayoutTests/fast/workers/worker-inherits-csp-blocks-xhr-expected.txt
>===================================================================
>--- LayoutTests/fast/workers/worker-inherits-csp-blocks-xhr-expected.txt	(revision 199007)
>+++ LayoutTests/fast/workers/worker-inherits-csp-blocks-xhr-expected.txt	(working copy)
>@@ -1,4 +1,4 @@
> CONSOLE MESSAGE: Refused to connect to non-existent-file because it does not appear in the connect-src directive of the Content Security Policy.
> This tests that the Content Security Policy (CSP) of the owner document (this page) blocks a file-URL Web Worker from making an XHR request because the parent's CSP contains "connect-src 'none'"
> 
>-PASS threw exception Error: SecurityError: DOM Exception 18.
>+PASS threw exception Error: NetworkError: DOM Exception 19.
>Index: LayoutTests/fast/workers/resources/worker-inherits-csp-blocks-xhr.js
>===================================================================
>--- LayoutTests/fast/workers/resources/worker-inherits-csp-blocks-xhr.js	(revision 199007)
>+++ LayoutTests/fast/workers/resources/worker-inherits-csp-blocks-xhr.js	(working copy)
>@@ -7,8 +7,8 @@ try {
> } catch (e) {
>     exception = e;
> }
>-// FIXME: We should be throwing a DOMException.NETWORK_ERR. See <https://bugs.webkit.org/show_bug.cgi?id=153598>.
>-var expectedExceptionCode = 18; // DOMException.SECURITY_ERR
>+
>+var expectedExceptionCode = 19; // DOMException.NETWORK_ERR
> if (!exception)
>     self.postMessage("FAIL should throw " + expectedExceptionCode + ". But did not throw an exception.");
> else {
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt	(revision 199007)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt	(working copy)
>@@ -1,3 +0,0 @@
>-CONSOLE MESSAGE: Refused to connect to http://localhost:8000/xmlhttprequest/resources/get.txt because it does not appear in the connect-src directive of the Content Security Policy.
>-Pass
>-
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html	(revision 199007)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html	(working copy)
>@@ -1,28 +0,0 @@
>-<!DOCTYPE html>
>-<html>
>-<head>
>-<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
>-<script>
>-if (window.testRunner)
>-    testRunner.dumpAsText();
>-</script>
>-</head>
>-<body>
>-<pre id="console"></pre>
>-<script>
>-function log(msg)
>-{
>-    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
>-}
>-
>-try {
>-    var xhr = new XMLHttpRequest;
>-    xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true); 
>-    log("Fail");
>-} catch(e) {
>-    log("Pass");
>-}
>-
>-</script>
>-</body>
>-</html>
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked-expected.txt	(working copy)
>@@ -0,0 +1,12 @@
>+CONSOLE MESSAGE: Refused to connect to http://localhost:8000/xmlhttprequest/resources/get.txt because it does not appear in the connect-src directive of the Content Security Policy.
>+This tests that a Content Security Policy violation for an XHR is triggered when calling XMLHttpRequest.send().
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true) did not throw exception.
>+PASS xhr.send() threw exception Error: NetworkError: DOM Exception 19.
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html	(revision 0)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-send-blocked.html	(working copy)
>@@ -0,0 +1,17 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
>+<script src="../../../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script>
>+description("This tests that a Content Security Policy violation for an XHR is triggered when calling XMLHttpRequest.send().");
>+
>+var xhr = new XMLHttpRequest;
>+shouldNotThrow('xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/get.txt", true)'); // Asynchronous request
>+shouldThrow("xhr.send()", "'Error: NetworkError: DOM Exception 19'");
>+</script>
>+<script src="/js-test-resources/js-test-post.js"></script>
>+</body>
>+</html>
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html	(revision 199007)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html	(working copy)
>@@ -17,7 +17,8 @@ function log(msg)
> 
> try {
>     var xhr = new XMLHttpRequest;
>-    xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true); 
>+    xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     log("Fail");
> } catch(e) {
>     log("Pass");
>Index: LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php
>===================================================================
>--- LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php	(revision 199007)
>+++ LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.php	(working copy)
>@@ -61,6 +61,7 @@ try {
> try {
>     var xhr = new XMLHttpRequest;
>     xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     postMessage("xhr allowed");
> } catch(e) {
>     postMessage("xhr blocked");
>@@ -118,6 +119,7 @@ onconnect = function (e) {
> try {
>     var xhr = new XMLHttpRequest;
>     xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/get.txt", true);
>+    xhr.send();
>     postMessage("xhr allowed");
> } catch(e) {
>     postMessage("xhr blocked");
>Index: LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt
>===================================================================
>--- LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt	(revision 199007)
>+++ LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt	(working copy)
>@@ -1,13 +1,14 @@
> CONSOLE MESSAGE: Refused to connect to http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt because it does not appear in the connect-src directive of the Content Security Policy.
>+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
> Tests that isolated worlds can have XHRs that the page's CSP wouldn't allow.
> 
> On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
> 
> 
> XHR from main world
>-PASS: XHR.open threw an exception.
>+PASS: XHR.send threw an exception.
> XHR from isolated world
>-PASS: XHR.open did not throw an exception.
>+PASS: XHR.send did not throw an exception.
> PASS successfullyParsed is true
> 
> TEST COMPLETE
>Index: LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html
>===================================================================
>--- LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html	(revision 199007)
>+++ LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html	(working copy)
>@@ -69,18 +69,21 @@ function xhr(shouldBlock)
>     }
> 
>     var xhr = new XMLHttpRequest();
>+    xhr.open('GET', 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt', true);
>     try {
>-        xhr.open('GET', 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt', true);
>+        xhr.onreadystatechange = function() {
>+            window.postMessage(JSON.stringify({'type': 'test-done'}), '*');
>+        };
>+        xhr.send();
>         if (shouldBlock)
>-            debug('FAIL: XHR.open should have thrown an exception.');
>+            debug('FAIL: XHR.send should have thrown an exception.');
>         else
>-            debug('PASS: XHR.open did not throw an exception.');
>+            debug('PASS: XHR.send did not throw an exception.');
>     } catch (e) {
>         if (shouldBlock)
>-            debug('PASS: XHR.open threw an exception.');
>+            debug('PASS: XHR.send threw an exception.');
>         else
>-            debug('FAIL: XHR.open should not have thrown an exception.');
>-    } finally {
>+            debug('FAIL: XHR.send should not have thrown an exception.');
>         window.postMessage(JSON.stringify({'type': 'test-done'}), '*');
>     }
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 153598: 275361 | 275362 | 275363 | 275365 | 275366 | 275413 | 275417 | 275431 | 275555 | 275557 | 275629 | 275928 | 275933 | 275966