Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(7)

Issue 19787002: CSP: 'eval()' blocked in report-only mode should send a violation report. (Closed)

Created:
7 years, 5 months ago by Mike West
Modified:
7 years, 4 months ago
Reviewers:
abarth-chromium
CC:
blink-reviews, dglazkov+blink, eae+blinkwatch, mkwst+watchlist_chromium.org
Visibility:
Public.

Description

CSP: 'eval()' blocked in report-only mode should send a violation report. Currently, 'eval()' is blocked inside V8 when an enforce-mode Content Security Policy is specified for a document. Report-only policies don't trigger this mechanism, and therefore can deliver violation reports neither to the 'report-uri' in the policy nor the console. This patch changes ContentSecurityPolicy::didReceiveHeader to disable eval inside V8 for report-only policies as well, and relies on the V8Initializer::codeGenerationCheckCallbackInMainThread callback to give V8 the final go/no-go decision regarding the code's execution. This patch has the negative performance side-effect of calling back from V8 to core whenever 'eval()' is encountered on a page with an CSP that blocks eval. Given that the page isn't expecting to run 'eval()' at all, that impact seems like something we can live with (though it is fairly significant). BUG=248257 R=abarth@chromium.org Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=155752

Patch Set 1 #

Patch Set 2 : rebase. #

Messages

Total messages: 15 (0 generated)
Mike West
Hi Adam! This patch follows up on http://src.chromium.org/viewvc/blink?view=rev&rev=153994 by asking V8 to trigger the code ...
7 years, 5 months ago (2013-07-19 07:22:36 UTC) #1
abarth-chromium
> That impact seems unnoticable in my experimentation Can you say a bit more about ...
7 years, 5 months ago (2013-07-19 08:04:15 UTC) #2
abarth-chromium
lgtm
7 years, 5 months ago (2013-07-19 08:05:09 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-status.appspot.com/cq/mkwst@chromium.org/19787002/1
7 years, 5 months ago (2013-07-19 08:05:28 UTC) #4
commit-bot: I haz the power
Retried try job too often on linux_layout for step(s) webkit_lint http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_layout&number=6199
7 years, 5 months ago (2013-07-19 08:24:47 UTC) #5
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-status.appspot.com/cq/mkwst@chromium.org/19787002/1
7 years, 5 months ago (2013-07-19 09:22:35 UTC) #6
Mike West
On 2013/07/19 08:04:15, abarth wrote: > > That impact seems unnoticable in my experimentation > ...
7 years, 5 months ago (2013-07-19 11:12:19 UTC) #7
abarth-chromium
You might want to try evaling a non-constant string so the compiler can't just optimize ...
7 years, 5 months ago (2013-07-19 18:19:38 UTC) #8
Mike West
On 2013/07/19 18:19:38, abarth wrote: > You might want to try evaling a non-constant string ...
7 years, 5 months ago (2013-07-22 15:24:39 UTC) #9
Mike West
On 2013/07/19 18:19:38, abarth wrote: > You might want to try evaling a non-constant string ...
7 years, 5 months ago (2013-07-22 15:28:14 UTC) #10
Mike West
On 2013/07/22 15:28:14, Mike West wrote: > On 2013/07/19 18:19:38, abarth wrote: > > You ...
7 years, 5 months ago (2013-07-22 15:32:06 UTC) #11
abarth-chromium
A factor of 2 doesn't sound that bad. The page isn't expecting to call eval ...
7 years, 5 months ago (2013-07-22 18:08:37 UTC) #12
Mike West
On 2013/07/22 18:08:37, abarth wrote: > A factor of 2 doesn't sound that bad. The ...
7 years, 5 months ago (2013-07-22 19:40:28 UTC) #13
Mike West
https://codereview.chromium.org/21789002/ landed, which resolves the spam issue you noted, Adam. I'll rebase this patch onto ...
7 years, 4 months ago (2013-08-08 08:16:05 UTC) #14
Mike West
7 years, 4 months ago (2013-08-08 08:22:11 UTC) #15
Message was sent while issue was closed.
Committed patchset #2 manually as r155752 (presubmit successful).

Powered by Google App Engine
This is Rietveld 408576698