Block Service Workers containing parts of their query string as XSS.

Source/web/WebEmbeddedWorkerImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 17 matching lines @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "web/WebEmbeddedWorkerImpl.h"
 
 #include "core/dom/CrossThreadTask.h"
 #include "core/dom/Document.h"
 #include "core/fetch/SubstituteData.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
+#include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/WorkerDebuggerAgent.h"
 #include "core/inspector/WorkerInspectorController.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/workers/WorkerClients.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerInspectorProxy.h"
 #include "core/workers/WorkerLoaderProxy.h"
 #include "core/workers/WorkerScriptLoader.h"
 #include "core/workers/WorkerThreadStartupData.h"
@@ skipping 14 matching lines @@
 #include "public/web/WebWorkerContentSettingsClientProxy.h"
 #include "web/ServiceWorkerGlobalScopeClientImpl.h"
 #include "web/ServiceWorkerGlobalScopeProxy.h"
 #include "web/WebDataSourceImpl.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WorkerContentSettingsClient.h"
 #include "wtf/Functional.h"
 
 namespace blink {
 
+namespace {
+
+    bool IsAmpersandOrEqualsSign(UChar character)
+    {
+        return character == '=' || character == '&';
+    }
+
+} // namespace
+
 WebEmbeddedWorker* WebEmbeddedWorker::create(WebServiceWorkerContextClient* client, WebWorkerContentSettingsClientProxy* contentSettingsClient)
 {
     return new WebEmbeddedWorkerImpl(adoptPtr(client), adoptPtr(contentSettingsClient));
 }
 
 static HashSet<WebEmbeddedWorkerImpl*>& runningWorkerInstances()
 {
     DEFINE_STATIC_LOCAL(HashSet<WebEmbeddedWorkerImpl*>, set, ());
     return set;
 }
@@ skipping 220 matching lines @@
         return;
     }
 
     Platform::current()->histogramCustomCounts("ServiceWorker.ScriptSize", m_mainScriptLoader->script().length(), 1000, 5000000, 50);
     if (m_mainScriptLoader->cachedMetadata())
         Platform::current()->histogramCustomCounts("ServiceWorker.ScriptCachedMetadataSize", m_mainScriptLoader->cachedMetadata()->size(), 1000, 50000000, 50);
 
     startWorkerThread();
 }
 
+String WebEmbeddedWorkerImpl::checkForReflectedXSS()
+{
+    ASSERT(m_mainScriptLoader);
+
+    String queryString = m_mainScriptLoader->url().query();
+    String script = m_mainScriptLoader->script();
+    String segment, decoded;
+    size_t offset = 0, next;
+
+    do {
+        next = queryString.find(IsAmpersandOrEqualsSign, offset);
+        if (next == kNotFound) {
+            segment = queryString.substring(offset);
+        } else {
+            offset = next + 1;
+            segment = queryString.substring(offset, next - offset);
+        }
+        if (segment.sizeInBytes() > 20) {

[Tom Sepez, 2015/08/31 16:41:19]

why 20?

+            decoded = decodeURLEscapeSequences(segment);
+            if (script.contains(segment)) {

[Tom Sepez, 2015/08/31 16:41:19]

what about multiple decodings? e.g. %2525332 etc. See XSSAuditor.

+                return segment;
+            }
+            if (script.contains(decoded)) {
+                return decoded;
+            }
+        }
+    } while (next != kNotFound);
+
+    return "";
+}
+
 void WebEmbeddedWorkerImpl::startWorkerThread()
 {
     ASSERT(!m_askedToTerminate);
 
     Document* document = m_mainFrame->frame()->document();
 
     WorkerThreadStartMode startMode = DontPauseWorkerGlobalScopeOnStart;
     if (InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart(document))
         startMode = PauseWorkerGlobalScopeOnStart;
 
     // FIXME: this document's origin is pristine and without any extra privileges. (crbug.com/254993)
     SecurityOrigin* starterOrigin = document->securityOrigin();
 
     OwnPtrWillBeRawPtr<WorkerClients> workerClients = WorkerClients::create();
     provideContentSettingsClientToWorker(workerClients.get(), m_contentSettingsClient.release());
     provideServiceWorkerGlobalScopeClientToWorker(workerClients.get(), ServiceWorkerGlobalScopeClientImpl::create(*m_workerContextClient));
     provideServiceWorkerContainerClientToWorker(workerClients.get(), adoptPtr(m_workerContextClient->createServiceWorkerProvider()));
 
     // We need to set the CSP to both the shadow page's document and the ServiceWorkerGlobalScope.
     document->initContentSecurityPolicy(m_mainScriptLoader->releaseContentSecurityPolicy());
 
+    // Verify that the query string contains nothing bad.
+    String script = m_mainScriptLoader->script();
+    String potentialXSS = checkForReflectedXSS();
+    if (potentialXSS != "") {
+        document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Service Worker script invocation blocked; contained \"" + potentialXSS + "\", which was a query string parameter."));
+        m_workerContextClient->workerContextFailedToStart();
+        return;
+    }
+
     KURL scriptURL = m_mainScriptLoader->url();
     OwnPtr<WorkerThreadStartupData> startupData = WorkerThreadStartupData::create(
         scriptURL,
         m_workerStartData.userAgent,
-        m_mainScriptLoader->script(),
+        script,
         m_mainScriptLoader->releaseCachedMetadata(),
         startMode,
         document->contentSecurityPolicy()->headers(),
         starterOrigin,
         workerClients.release(),
         static_cast<V8CacheOptions>(m_workerStartData.v8CacheOptions));
 
     m_mainScriptLoader.clear();
 
     m_workerGlobalScopeProxy = ServiceWorkerGlobalScopeProxy::create(*this, *document, *m_workerContextClient);
     m_loaderProxy = WorkerLoaderProxy::create(this);
     m_workerThread = ServiceWorkerThread::create(m_loaderProxy, *m_workerGlobalScopeProxy);
     m_workerThread->start(startupData.release());
     m_workerInspectorProxy->workerThreadCreated(document, m_workerThread.get(), scriptURL);
 }
 
 } // namespace blink