153150 2016-01-15 14:55:04 -0800 CSP: Fire 'load' events even when blocking loads via 'frame-src'. 2016-05-27 16:34:30 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Local Build All All RESOLVED FIXED BlinkMergeCandidate, InRadar P2 Normal --- 1 dbates bfulgham bfulgham cdumez commit-queue dbates japhet mkwst webkit-bug-importer oldest_to_newest 1155956 0 dbates 2016-01-15 14:55:04 -0800 We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=165743>. CSP: Fire 'load' events even when blocking loads via 'frame-src'. If we fire a 'load' event, the frame looks just like any other cross-origin load that succeeded. If we don't fire a 'load' event, timing attacks can gain knowledge about the URL in the frame by blocking the URL in a page's CSP, and waiting long enough to be sure that a 'load' event _would_ have fired if the load wasn't blocked. 1159597 1 webkit-bug-importer 2016-01-27 20:31:50 -0800 <rdar://problem/24383162> 1197190 2 279986 bfulgham 2016-05-27 13:26:13 -0700 Created attachment 279986 Patch 1197196 3 279986 dbates 2016-05-27 13:35:13 -0700 Comment on attachment 279986 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=279986&action=review > LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt:17 > PASS successfullyParsed is true > > TEST COMPLETE > +PASS successfullyParsed is true > + > +TEST COMPLETE This output does not look correctly. 1197199 4 bfulgham 2016-05-27 13:48:52 -0700 Committed r201468: <http://trac.webkit.org/changeset/201468> 1197271 5 bfulgham 2016-05-27 16:34:30 -0700 Landed a fix for test flakiness in r201472 <http://trac.webkit.org/changeset/201472>. 279986 2016-05-27 13:26:13 -0700 2016-05-27 13:35:13 -0700 Patch bug-153150-20160527132724.patch text/plain 5148 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMTQ2MykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDE2LTA1LTI3ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIENTUDogRmlyZSAnbG9hZCcg ZXZlbnRzIGV2ZW4gd2hlbiBibG9ja2luZyBsb2FkcyB2aWEgJ2ZyYW1lLXNyYycuCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTMxNTAKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzI0MzgzMTYyPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFsd2F5cyBmaXJlIGEgbG9hZCBldmVudCwgZXZlbiB3aGVuIHRo ZSBsb2FkIGlzIGJsb2NrZWQgYnkgQ1NQIHJ1bGVzLCBzbyB0aGF0CisgICAgICAgIGF0dGFja2Vy cyBjYW5ub3QgZ2FpbiBrbm93bGVkZ2UgYWJvdXQgdGhlIFVSTCBpbiB0aGUgZnJhbWUgYnkgYmxv Y2tpbmcgdGhlCisgICAgICAgIGxvYWQgYW5kIHdhaXRpbmcgbG9uZyBlbm91Z2ggdG8gYmUgc3Vy ZSB0aGF0IGEgJ2xvYWQnIGV2ZW50IHdvdWxkIGhhdmUKKyAgICAgICAgZmlyZWQgaWYgdGhlIGxv YWQgd2Fzbid0IGJsb2NrZWQuCisKKyAgICAgICAgSW5zcGlyZWQgYnkgQmxpbmsgcGF0Y2g6Cisg ICAgICAgIDxodHRwczovL3NyYy5jaHJvbWl1bS5vcmcvdmlld3ZjL2JsaW5rP3ZpZXc9cmV2JnJl dmlzaW9uPTE2NTc0Mz4KKworICAgICAgICBUZXN0czogaHR0cC90ZXN0cy9zZWN1cml0eS9jb250 ZW50U2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdpbi1sb2FkLmh0bWwKKworICAg ICAgICAqIGxvYWRlci9Qb2xpY3lDaGVja2VyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlBvbGlj eUNoZWNrZXI6OmNoZWNrTmF2aWdhdGlvblBvbGljeSk6CisKIDIwMTYtMDUtMjcgIFJ5YW4gSGFk ZGFkICA8cnlhbmhhZGRhZEBhcHBsZS5jb20+CiAKICAgICAgICAgQXR0ZW1wdCB0byBmaXggdGhl IGlPUyBidWlsZC4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2xvYWRlci9Qb2xpY3lDaGVja2VyLmNw cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9sb2FkZXIvUG9saWN5Q2hlY2tlci5jcHAJ KHJldmlzaW9uIDIwMTQzMSkKKysrIFNvdXJjZS9XZWJDb3JlL2xvYWRlci9Qb2xpY3lDaGVja2Vy LmNwcAkod29ya2luZyBjb3B5KQpAQCAtOTgsNiArOTgsMTEgQEAgdm9pZCBQb2xpY3lDaGVja2Vy OjpjaGVja05hdmlnYXRpb25Qb2xpYwogICAgIH0KIAogICAgIGlmICghaXNBbGxvd2VkQnlDb250 ZW50U2VjdXJpdHlQb2xpY3kocmVxdWVzdC51cmwoKSwgbV9mcmFtZS5vd25lckVsZW1lbnQoKSwg ZGlkUmVjZWl2ZVJlZGlyZWN0UmVzcG9uc2UpKSB7CisgICAgICAgIGlmIChtX2ZyYW1lLm93bmVy RWxlbWVudCgpKSB7CisgICAgICAgICAgICAvLyBGaXJlIGEgbG9hZCBldmVudCAoZXZlbiB0aG91 Z2ggd2Ugd2VyZSBibG9ja2VkIGJ5IENTUCkgYXMgdGltaW5nIGF0dGFja3Mgd291bGQgb3RoZXJ3 aXNlCisgICAgICAgICAgICAvLyByZXZlYWwgdGhhdCB0aGUgZnJhbWUgd2FzIGJsb2NrZWQuIFRo aXMgd2F5LCBpdCBsb29rcyBsaWtlIGFueSBvdGhlciBjcm9zcy1vcmlnaW4gcGFnZSBsb2FkLgor ICAgICAgICAgICAgbV9mcmFtZS5vd25lckVsZW1lbnQoKS0+ZGlzcGF0Y2hFdmVudChFdmVudDo6 Y3JlYXRlKGV2ZW50TmFtZXMoKS5sb2FkRXZlbnQsIGZhbHNlLCBmYWxzZSkpOworICAgICAgICB9 CiAgICAgICAgIGZ1bmN0aW9uKHJlcXVlc3QsIDAsIGZhbHNlKTsKICAgICAgICAgcmV0dXJuOwog ICAgIH0KSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU ZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMTQzOSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE2LTA1LTI3ICBCcmVudCBGdWxn aGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIENTUDogRmlyZSAnbG9hZCcgZXZl bnRzIGV2ZW4gd2hlbiBibG9ja2luZyBsb2FkcyB2aWEgJ2ZyYW1lLXNyYycuCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTMxNTAKKyAgICAgICAgPHJk YXI6Ly9wcm9ibGVtLzI0MzgzMTYyPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogVGVzdEV4cGVjdGF0aW9uczogVW5za2lwIHRoZSBjcm9zcy1vcmln aW4gbG9hZCB0ZXN0LgorICAgICAgICAqIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3Vy aXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9zcy1vcmlnaW4tbG9hZC1leHBlY3RlZC50eHQ6IFVwZGF0 ZSB0byBtYXRjaAorICAgICAgICBvdXIgbWVzc2FnZSBmb3JtYXQuCisKIDIwMTYtMDUtMjYgIEJy ZW50IEZ1bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CiAKICAgICAgICAgRE9NIG11dGF0aW9u IG1ldGhvZHMgZmFpbCB0byByZS1jaGVjayB2YWxpZGl0eSBvZiBub2RlIGluc2VydGlvbiBhZnRl ciByZW1vdmluZyBub2RlcyBmcm9tIG9sZCBwYXJlbnQKSW5kZXg6IExheW91dFRlc3RzL1Rlc3RF eHBlY3RhdGlvbnMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvVGVzdEV4cGVjdGF0aW9ucwko cmV2aXNpb24gMjAxNDMxKQorKysgTGF5b3V0VGVzdHMvVGVzdEV4cGVjdGF0aW9ucwkod29ya2lu ZyBjb3B5KQpAQCAtODQyLDcgKzg0Miw2IEBAIHdlYmtpdC5vcmcvYi8xMTE4NjkgaHR0cC90ZXN0 cy9zZWN1cml0eS8KIHdlYmtpdC5vcmcvYi8xNTMxNDggaHR0cC90ZXN0cy9zZWN1cml0eS9jb250 ZW50U2VjdXJpdHlQb2xpY3kvZXZhbC1hbGxvd2VkLWluLXJlcG9ydC1vbmx5LW1vZGUtYW5kLXNl bmRzLXJlcG9ydC5waHAKIHdlYmtpdC5vcmcvYi8xNTMxNTAgaHR0cC90ZXN0cy9zZWN1cml0eS9j b250ZW50U2VjdXJpdHlQb2xpY3kvMS4xL2NoaWxkLXNyYy9mcmFtZS1maXJlcy1sb2FkLWV2ZW50 LXdoZW4tYmxvY2tlZC5odG1sCiB3ZWJraXQub3JnL2IvMTUzMTUwIGh0dHAvdGVzdHMvc2VjdXJp dHkvY29udGVudFNlY3VyaXR5UG9saWN5LzEuMS9jaGlsZC1zcmMvZnJhbWUtZmlyZXMtbG9hZC1l dmVudC13aGVuLXJlZGlyZWN0LWJsb2NrZWQuaHRtbAotd2Via2l0Lm9yZy9iLzE1MzE1MCBodHRw L3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9mcmFtZS1zcmMtY3Jvc3Mtb3Jp Z2luLWxvYWQuaHRtbAogd2Via2l0Lm9yZy9iLzE1MzE1MiBodHRwL3Rlc3RzL3NlY3VyaXR5L2Nv bnRlbnRTZWN1cml0eVBvbGljeS9tYW5pZmVzdC1zcmMtYWxsb3dlZC5odG1sICMgTmVlZHMgdGVz dFJ1bm5lci5nZXRNYW5pZmVzdFRoZW4oKQogd2Via2l0Lm9yZy9iLzE1MzE1MiBodHRwL3Rlc3Rz L3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9tYW5pZmVzdC1zcmMtYmxvY2tlZC5odG1s ICMgTmVlZHMgdGVzdFJ1bm5lci5nZXRNYW5pZmVzdFRoZW4oKQogd2Via2l0Lm9yZy9iLzE1MzE1 NSBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS8xLjEvc2NyaXB0aGFz aC1iYXNpYy1ibG9ja2VkLWVycm9yLWV2ZW50Lmh0bWwKSW5kZXg6IExheW91dFRlc3RzL2h0dHAv dGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L2ZyYW1lLXNyYy1jcm9zcy1vcmln aW4tbG9hZC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdpbi1s b2FkLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMjAxNDMxKQorKysgTGF5b3V0VGVzdHMvaHR0cC90 ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvZnJhbWUtc3JjLWNyb3NzLW9yaWdp bi1sb2FkLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDQgQEAKLUNPTlNP TEUgTUVTU0FHRTogbGluZSAyNDogUmVmdXNlZCB0byBmcmFtZSAnaHR0cHM6Ly9sb2NhbGhvc3Q6 ODQ0My9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2VzL2FsZXJ0LWZhaWwu aHRtbCcgYmVjYXVzZSBpdCB2aW9sYXRlcyB0aGUgZm9sbG93aW5nIENvbnRlbnQgU2VjdXJpdHkg UG9saWN5IGRpcmVjdGl2ZTogImZyYW1lLXNyYyAnc2VsZicgaHR0cDovL2xvY2FsaG9zdDo4MDgw Ii4KLQorQ09OU09MRSBNRVNTQUdFOiBSZWZ1c2VkIHRvIGxvYWQgaHR0cHM6Ly9sb2NhbGhvc3Q6 ODQ0My9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvcmVzb3VyY2VzL2FsZXJ0LWZhaWwu aHRtbCBiZWNhdXNlIGl0IGRvZXMgbm90IGFwcGVhciBpbiB0aGUgZnJhbWUtc3JjIGRpcmVjdGl2 ZSBvZiB0aGUgQ29udGVudCBTZWN1cml0eSBQb2xpY3kuCiBBTEVSVDogUEFTUwogQUxFUlQ6IFBB U1MKIElGcmFtZXMgYmxvY2tlZCBieSBDU1Agc2hvdWxkIGdlbmVyYXRlIGEgJ2xvYWQnIGV2ZW50 LCByZWdhcmRsZXNzIG9mIGJsb2NrZWQgc3RhdGUuIFRoaXMgbWVhbnMgdGhleSBhcHBlYXIgdG8g YmUgbm9ybWFsIGNyb3NzLW9yaWdpbiBsb2FkcywgdGhlcmVieSBub3QgbGVha2luZyBVUkwgaW5m b3JtYXRpb24gZGlyZWN0bHkgdG8gSlMuCkBAIC0xMyw0ICsxMiw3IEBAIFBBU1MgSUZyYW1lICMz IGdlbmVyYXRlZCBhICdsb2FkJyBldmVudC4KIFBBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRy dWUKIAogVEVTVCBDT01QTEVURQorUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQorCitU RVNUIENPTVBMRVRFCiAgICAK