OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "core/frame/csp/CSPDirectiveList.h" | 5 #include "core/frame/csp/CSPDirectiveList.h" |
6 | 6 |
7 #include "bindings/core/v8/SourceLocation.h" | 7 #include "bindings/core/v8/SourceLocation.h" |
8 #include "core/dom/Document.h" | 8 #include "core/dom/Document.h" |
9 #include "core/dom/SecurityContext.h" | 9 #include "core/dom/SecurityContext.h" |
10 #include "core/dom/SpaceSplitString.h" | 10 #include "core/dom/SpaceSplitString.h" |
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
48 , m_headerType(type) | 48 , m_headerType(type) |
49 , m_headerSource(source) | 49 , m_headerSource(source) |
50 , m_reportOnly(false) | 50 , m_reportOnly(false) |
51 , m_hasSandboxPolicy(false) | 51 , m_hasSandboxPolicy(false) |
52 , m_reflectedXSSDisposition(ReflectedXSSUnset) | 52 , m_reflectedXSSDisposition(ReflectedXSSUnset) |
53 , m_didSetReferrerPolicy(false) | 53 , m_didSetReferrerPolicy(false) |
54 , m_referrerPolicy(ReferrerPolicyDefault) | 54 , m_referrerPolicy(ReferrerPolicyDefault) |
55 , m_strictMixedContentCheckingEnforced(false) | 55 , m_strictMixedContentCheckingEnforced(false) |
56 , m_upgradeInsecureRequests(false) | 56 , m_upgradeInsecureRequests(false) |
57 , m_treatAsPublicAddress(false) | 57 , m_treatAsPublicAddress(false) |
58 , m_requireSRIFor(RequireSRIForToken::None) | |
58 { | 59 { |
59 m_reportOnly = type == ContentSecurityPolicyHeaderTypeReport; | 60 m_reportOnly = type == ContentSecurityPolicyHeaderTypeReport; |
60 } | 61 } |
61 | 62 |
62 CSPDirectiveList* CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSec urityPolicyHeaderSource source) | 63 CSPDirectiveList* CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSec urityPolicyHeaderSource source) |
63 { | 64 { |
64 CSPDirectiveList* directives = new CSPDirectiveList(policy, type, source); | 65 CSPDirectiveList* directives = new CSPDirectiveList(policy, type, source); |
65 directives->parse(begin, end); | 66 directives->parse(begin, end); |
66 | 67 |
67 if (!directives->checkEval(directives->operativeDirective(directives->m_scri ptSrc.get()))) { | 68 if (!directives->checkEval(directives->operativeDirective(directives->m_scri ptSrc.get()))) { |
(...skipping 98 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
166 // | 167 // |
167 // TODO(mkwst): Move this check up into the browser process. See | 168 // TODO(mkwst): Move this check up into the browser process. See |
168 // https://crbug.com/555418. | 169 // https://crbug.com/555418. |
169 KURL url(KURL(), current->securityContext()->getSecurityOrigin()->toStri ng()); | 170 KURL url(KURL(), current->securityContext()->getSecurityOrigin()->toStri ng()); |
170 if (!directive->allows(url, ResourceRequest::RedirectStatus::NoRedirect) ) | 171 if (!directive->allows(url, ResourceRequest::RedirectStatus::NoRedirect) ) |
171 return false; | 172 return false; |
172 } | 173 } |
173 return true; | 174 return true; |
174 } | 175 } |
175 | 176 |
177 bool CSPDirectiveList::checkRequestWithoutIntegrity(WebURLRequest::RequestContex t context) const | |
178 { | |
179 if (m_requireSRIFor == RequireSRIForToken::None) | |
180 return true; | |
181 // SRI specification (https://w3c.github.io/webappsec-subresource-integrity/ #apply-algorithm-to-request) | |
182 // says to match token with request's destination with the token. | |
183 // Keep this logic aligned with ContentSecurityPolicy::allowRequest | |
184 if ((m_requireSRIFor & RequireSRIForToken::Script) | |
185 && (context == WebURLRequest::RequestContextScript | |
186 || context == WebURLRequest::RequestContextImport | |
187 || context == WebURLRequest::RequestContextServiceWorker | |
188 || context == WebURLRequest::RequestContextSharedWorker | |
189 || context == WebURLRequest::RequestContextWorker)) { | |
190 return false; | |
Mike West
2016/06/24 17:50:49
Here and on #193, you should be returning `denyIfE
| |
191 } | |
192 if ((m_requireSRIFor & RequireSRIForToken::Style) && context == WebURLReques t::RequestContextStyle) | |
193 return false; | |
194 return true; | |
195 } | |
196 | |
197 bool CSPDirectiveList::checkRequestWithoutIntegrityAndReportViolation(WebURLRequ est::RequestContext context, const KURL& url, ResourceRequest::RedirectStatus re directStatus) const | |
198 { | |
199 if (checkRequestWithoutIntegrity(context)) | |
200 return true; | |
201 String resourceType; | |
202 switch (context) { | |
203 case WebURLRequest::RequestContextScript: | |
204 case WebURLRequest::RequestContextImport: | |
205 resourceType = "script"; | |
206 break; | |
207 case WebURLRequest::RequestContextStyle: | |
208 resourceType = "stylesheet"; | |
209 break; | |
210 case WebURLRequest::RequestContextServiceWorker: | |
211 resourceType = "service worker"; | |
212 break; | |
213 case WebURLRequest::RequestContextSharedWorker: | |
214 resourceType = "shared worker"; | |
215 break; | |
216 case WebURLRequest::RequestContextWorker: | |
217 resourceType = "worker"; | |
218 break; | |
219 default: | |
220 break; | |
221 } | |
222 reportViolation(ContentSecurityPolicy::RequireSRIFor, ContentSecurityPolicy: :RequireSRIFor, "Refused to load the " + resourceType + " '" + url.elidedString( ) + "' because 'require-sri-for' directive requires integrity attribute be prese nt for all " + resourceType + "s.", url, redirectStatus); | |
223 return denyIfEnforcingPolicy(); | |
224 } | |
225 | |
226 bool CSPDirectiveList::allowRequestWithoutIntegrity(WebURLRequest::RequestContex t context, const KURL& url, ResourceRequest::RedirectStatus redirectStatus, Cont entSecurityPolicy::ReportingStatus reportingStatus) const | |
227 { | |
228 if (reportingStatus == ContentSecurityPolicy::SendReport) | |
229 return checkRequestWithoutIntegrityAndReportViolation(context, url, redi rectStatus); | |
230 return checkRequestWithoutIntegrity(context); | |
231 } | |
232 | |
176 bool CSPDirectiveList::checkMediaType(MediaListDirective* directive, const Strin g& type, const String& typeAttribute) const | 233 bool CSPDirectiveList::checkMediaType(MediaListDirective* directive, const Strin g& type, const String& typeAttribute) const |
177 { | 234 { |
178 if (!directive) | 235 if (!directive) |
179 return true; | 236 return true; |
180 if (typeAttribute.isEmpty() || typeAttribute.stripWhiteSpace() != type) | 237 if (typeAttribute.isEmpty() || typeAttribute.stripWhiteSpace() != type) |
181 return false; | 238 return false; |
182 return directive->allows(type); | 239 return directive->allows(type); |
183 } | 240 } |
184 | 241 |
185 SourceListDirective* CSPDirectiveList::operativeDirective(SourceListDirective* d irective) const | 242 SourceListDirective* CSPDirectiveList::operativeDirective(SourceListDirective* d irective) const |
(...skipping 358 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
544 } | 601 } |
545 | 602 |
546 // The directive-value may be empty. | 603 // The directive-value may be empty. |
547 if (valueBegin == position) | 604 if (valueBegin == position) |
548 return true; | 605 return true; |
549 | 606 |
550 value = String(valueBegin, position - valueBegin); | 607 value = String(valueBegin, position - valueBegin); |
551 return true; | 608 return true; |
552 } | 609 } |
553 | 610 |
611 void CSPDirectiveList::parseRequireSRIFor(const String& name, const String& valu e) | |
612 { | |
613 if (m_requireSRIFor != 0) { | |
614 m_policy->reportDuplicateDirective(name); | |
615 return; | |
616 } | |
617 StringBuilder tokenErrors; | |
618 unsigned numberOfTokenErrors = 0; | |
619 Vector<UChar> characters; | |
620 value.appendTo(characters); | |
621 | |
622 const UChar* position = characters.data(); | |
623 const UChar* end = position + characters.size(); | |
624 | |
625 while (position < end) { | |
626 skipWhile<UChar, isASCIISpace>(position, end); | |
627 | |
628 const UChar* tokenBegin = position; | |
629 skipWhile<UChar, isNotASCIISpace>(position, end); | |
630 | |
631 if (tokenBegin < position) { | |
632 String token = String(tokenBegin, position - tokenBegin); | |
633 if (equalIgnoringCase(token, "script")) { | |
634 m_requireSRIFor |= RequireSRIForToken::Script; | |
635 } else if (equalIgnoringCase(token, "style")) { | |
636 m_requireSRIFor |= RequireSRIForToken::Style; | |
637 } else { | |
638 if (numberOfTokenErrors) | |
639 tokenErrors.append(", \'"); | |
640 else | |
641 tokenErrors.append('\''); | |
642 tokenErrors.append(token); | |
643 tokenErrors.append('\''); | |
644 numberOfTokenErrors++; | |
645 } | |
646 } | |
647 } | |
648 | |
649 if (numberOfTokenErrors == 0) | |
650 return; | |
651 | |
652 String invalidTokensErrorMessage; | |
653 if (numberOfTokenErrors > 1) | |
654 tokenErrors.append(" are invalid 'require-sri-for' tokens."); | |
655 else | |
656 tokenErrors.append(" is an invalid 'require-sri-for' token."); | |
657 | |
658 invalidTokensErrorMessage = tokenErrors.toString(); | |
659 | |
660 DCHECK(!invalidTokensErrorMessage.isEmpty()); | |
661 | |
662 m_policy->reportInvalidRequireSRIForTokens(invalidTokensErrorMessage); | |
663 } | |
664 | |
554 void CSPDirectiveList::parseReportURI(const String& name, const String& value) | 665 void CSPDirectiveList::parseReportURI(const String& name, const String& value) |
555 { | 666 { |
556 if (!m_reportEndpoints.isEmpty()) { | 667 if (!m_reportEndpoints.isEmpty()) { |
557 m_policy->reportDuplicateDirective(name); | 668 m_policy->reportDuplicateDirective(name); |
558 return; | 669 return; |
559 } | 670 } |
560 | 671 |
561 // Remove report-uri in meta policies, per https://www.w3.org/TR/CSP2/#deliv ery-html-meta-element. | 672 // Remove report-uri in meta policies, per https://www.w3.org/TR/CSP2/#deliv ery-html-meta-element. |
562 if (m_headerSource == ContentSecurityPolicyHeaderSourceMeta) { | 673 if (m_headerSource == ContentSecurityPolicyHeaderSourceMeta) { |
563 UseCounter::count(m_policy->document(), UseCounter::InvalidReportUriDire ctiveInMetaCSP); | 674 UseCounter::count(m_policy->document(), UseCounter::InvalidReportUriDire ctiveInMetaCSP); |
(...skipping 253 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
817 } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) { | 928 } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) { |
818 parseReferrer(name, value); | 929 parseReferrer(name, value); |
819 } else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureReq uests)) { | 930 } else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureReq uests)) { |
820 enableInsecureRequestsUpgrade(name, value); | 931 enableInsecureRequestsUpgrade(name, value); |
821 } else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedConte nt)) { | 932 } else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedConte nt)) { |
822 enforceStrictMixedContentChecking(name, value); | 933 enforceStrictMixedContentChecking(name, value); |
823 } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) { | 934 } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) { |
824 setCSPDirective<SourceListDirective>(name, value, m_manifestSrc); | 935 setCSPDirective<SourceListDirective>(name, value, m_manifestSrc); |
825 } else if (equalIgnoringCase(name, ContentSecurityPolicy::TreatAsPublicAddre ss)) { | 936 } else if (equalIgnoringCase(name, ContentSecurityPolicy::TreatAsPublicAddre ss)) { |
826 treatAsPublicAddress(name, value); | 937 treatAsPublicAddress(name, value); |
938 } else if (equalIgnoringCase(name, ContentSecurityPolicy::RequireSRIFor) && m_policy->experimentalFeaturesEnabled()) { | |
939 parseRequireSRIFor(name, value); | |
827 } else { | 940 } else { |
828 m_policy->reportUnsupportedDirective(name); | 941 m_policy->reportUnsupportedDirective(name); |
829 } | 942 } |
830 } | 943 } |
831 | 944 |
832 DEFINE_TRACE(CSPDirectiveList) | 945 DEFINE_TRACE(CSPDirectiveList) |
833 { | 946 { |
834 visitor->trace(m_policy); | 947 visitor->trace(m_policy); |
835 visitor->trace(m_pluginTypes); | 948 visitor->trace(m_pluginTypes); |
836 visitor->trace(m_baseURI); | 949 visitor->trace(m_baseURI); |
837 visitor->trace(m_childSrc); | 950 visitor->trace(m_childSrc); |
838 visitor->trace(m_connectSrc); | 951 visitor->trace(m_connectSrc); |
839 visitor->trace(m_defaultSrc); | 952 visitor->trace(m_defaultSrc); |
840 visitor->trace(m_fontSrc); | 953 visitor->trace(m_fontSrc); |
841 visitor->trace(m_formAction); | 954 visitor->trace(m_formAction); |
842 visitor->trace(m_frameAncestors); | 955 visitor->trace(m_frameAncestors); |
843 visitor->trace(m_frameSrc); | 956 visitor->trace(m_frameSrc); |
844 visitor->trace(m_imgSrc); | 957 visitor->trace(m_imgSrc); |
845 visitor->trace(m_mediaSrc); | 958 visitor->trace(m_mediaSrc); |
846 visitor->trace(m_manifestSrc); | 959 visitor->trace(m_manifestSrc); |
847 visitor->trace(m_objectSrc); | 960 visitor->trace(m_objectSrc); |
848 visitor->trace(m_scriptSrc); | 961 visitor->trace(m_scriptSrc); |
849 visitor->trace(m_styleSrc); | 962 visitor->trace(m_styleSrc); |
850 } | 963 } |
851 | 964 |
852 | 965 |
853 } // namespace blink | 966 } // namespace blink |
OLD | NEW |