Implement the `require-sri-for` CSP directive

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 37 matching lines @@
     , m_headerType(type)
     , m_headerSource(source)
     , m_reportOnly(false)
     , m_hasSandboxPolicy(false)
     , m_reflectedXSSDisposition(ReflectedXSSUnset)
     , m_didSetReferrerPolicy(false)
     , m_referrerPolicy(ReferrerPolicyDefault)
     , m_strictMixedContentCheckingEnforced(false)
     , m_upgradeInsecureRequests(false)
     , m_treatAsPublicAddress(false)
+    , m_requireSRIFor(0)
 {
     m_reportOnly = type == ContentSecurityPolicyHeaderTypeReport;
 }
 
 CSPDirectiveList* CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
 {
     CSPDirectiveList* directives = new CSPDirectiveList(policy, type, source);
     directives->parse(begin, end);
 
     if (!directives->checkEval(directives->operativeDirective(directives->m_scriptSrc.get()))) {
@@ skipping 98 matching lines @@
         //
         // TODO(mkwst): Move this check up into the browser process.  See
         // https://crbug.com/555418.
         KURL url(KURL(), current->securityContext()->getSecurityOrigin()->toString());
         if (!directive->allows(url, ResourceRequest::RedirectStatus::NoRedirect))
             return false;
     }
     return true;
 }
 
+bool CSPDirectiveList::checkRequestWithoutIntegrity(WebURLRequest::RequestContext context) const
+{
+    if (m_requireSRIFor == 0)

[Mike West, 2016/06/20 08:11:37]

Nit: Prefer `if (!m_requireSRIFor)` or `if (m_requireSRIFor ==
RequireSRIForToken::None)`.

[Sergey Shekyan, 2016/06/21 06:34:51]

Acknowledged.

+        return true;
+    // SRI specification (https://w3c.github.io/webappsec-subresource-integrity/#apply-algorithm-to-request)
+    // says to match token with request's destination with the token.
+    // Keep this logic aligned with ContentSecurityPolicy::allowRequest
+    if (m_requireSRIFor & RequireSRIForToken::Script && (context == WebURLRequest::RequestContextScript || context == WebURLRequest::RequestContextImport)) {
+        return false;
+    }
+    if (m_requireSRIFor & RequireSRIForToken::Style && context == WebURLRequest::RequestContextStyle) {
+        return false;
+    }
+    return true;
+}
+
+bool CSPDirectiveList::checkRequestWithoutIntegrityAndReportViolation(WebURLRequest::RequestContext context, const KURL& url, ResourceRequest::RedirectStatus redirectStatus) const
+{
+    if (checkRequestWithoutIntegrity(context))
+        return true;
+    String resourceType;
+    if (context == WebURLRequest::RequestContextScript || context == WebURLRequest::RequestContextImport)
+        resourceType = "script";
+    else if (context == WebURLRequest::RequestContextStyle)
+        resourceType = "stylesheet";
+    reportViolation(ContentSecurityPolicy::RequireSRIFor, ContentSecurityPolicy::RequireSRIFor, "Refused to load the " + resourceType + " '" + url.elidedString() + "' because 'require-sri-for' directive requires integrity attribute be present for all " + resourceType + "s.", url, redirectStatus);
+    return denyIfEnforcingPolicy();
+}
+
+bool CSPDirectiveList::allowRequestWithoutIntegrity(WebURLRequest::RequestContext context, const KURL& url, ResourceRequest::RedirectStatus redirectStatus, ContentSecurityPolicy::ReportingStatus reportingStatus) const
+{
+    if (reportingStatus == ContentSecurityPolicy::SendReport) {
+        return checkRequestWithoutIntegrityAndReportViolation(context, url, redirectStatus);
+    }

[Mike West, 2016/06/20 08:11:37]

Nit: No {} for single-line bodies.

[Sergey Shekyan, 2016/06/21 06:34:51]

Acknowledged.

+    return checkRequestWithoutIntegrity(context);
+}
+
 bool CSPDirectiveList::checkMediaType(MediaListDirective* directive, const String& type, const String& typeAttribute) const
 {
     if (!directive)
         return true;
     if (typeAttribute.isEmpty() || typeAttribute.stripWhiteSpace() != type)
         return false;
     return directive->allows(type);
 }
 
 SourceListDirective* CSPDirectiveList::operativeDirective(SourceListDirective* directive) const
@@ skipping 358 matching lines @@
     }
 
     // The directive-value may be empty.
     if (valueBegin == position)
         return true;
 
     value = String(valueBegin, position - valueBegin);
     return true;
 }
 
+void CSPDirectiveList::parseRequireSRIFor(const String& name, const String& value)
+{
+    if (m_requireSRIFor != 0) {
+        m_policy->reportDuplicateDirective(name);
+        return;
+    }
+    StringBuilder tokenErrors;
+    unsigned numberOfTokenErrors = 0;
+    Vector<UChar> characters;
+    value.appendTo(characters);
+
+    const UChar* position = characters.data();
+    const UChar* end = position + characters.size();
+
+    while (position < end) {
+        skipWhile<UChar, isASCIISpace>(position, end);
+
+        const UChar* tokenBegin = position;
+        skipWhile<UChar, isNotASCIISpace>(position, end);
+
+        if (tokenBegin < position) {
+            String token = String(tokenBegin, position - tokenBegin);
+            if (equalIgnoringCase(token, "script")) {
+                m_requireSRIFor |= RequireSRIForToken::Script;
+            } else if (equalIgnoringCase(token, "style")) {
+                m_requireSRIFor |= RequireSRIForToken::Style;
+            } else {
+                if (numberOfTokenErrors)
+                    tokenErrors.append(", \'");
+                else
+                    tokenErrors.append('\'');
+                tokenErrors.append(token);
+                tokenErrors.append('\'');
+                numberOfTokenErrors++;
+            }
+        }
+    }
+
+    if (numberOfTokenErrors == 0)
+        return;
+
+    String invalidTokensErrorMessage;
+    if (numberOfTokenErrors > 1)
+        tokenErrors.append(" are invalid 'require-sri-for' tokens.");
+    else
+        tokenErrors.append(" is an invalid 'require-sri-for' token.");
+
+    invalidTokensErrorMessage = tokenErrors.toString();
+
+    DCHECK(!invalidTokensErrorMessage.isEmpty());
+
+    m_policy->reportInvalidRequireSRIForTokens(invalidTokensErrorMessage);
+}
+
 void CSPDirectiveList::parseReportURI(const String& name, const String& value)
 {
     if (!m_reportEndpoints.isEmpty()) {
         m_policy->reportDuplicateDirective(name);
         return;
     }
 
     // Remove report-uri in meta policies, per https://www.w3.org/TR/CSP2/#delivery-html-meta-element.
     if (m_headerSource == ContentSecurityPolicyHeaderSourceMeta) {
         UseCounter::count(m_policy->document(), UseCounter::InvalidReportUriDirectiveInMetaCSP);
@@ skipping 253 matching lines @@
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) {
         parseReferrer(name, value);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureRequests)) {
         enableInsecureRequestsUpgrade(name, value);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedContent)) {
         enforceStrictMixedContentChecking(name, value);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::TreatAsPublicAddress)) {
         treatAsPublicAddress(name, value);
+    } else if (equalIgnoringCase(name, ContentSecurityPolicy::RequireSRIFor) && m_policy->experimentalFeaturesEnabled()) {
+        parseRequireSRIFor(name, value);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 DEFINE_TRACE(CSPDirectiveList)
 {
     visitor->trace(m_policy);
     visitor->trace(m_pluginTypes);
     visitor->trace(m_baseURI);
     visitor->trace(m_childSrc);
     visitor->trace(m_connectSrc);
     visitor->trace(m_defaultSrc);
     visitor->trace(m_fontSrc);
     visitor->trace(m_formAction);
     visitor->trace(m_frameAncestors);
     visitor->trace(m_frameSrc);
     visitor->trace(m_imgSrc);
     visitor->trace(m_mediaSrc);
     visitor->trace(m_manifestSrc);
     visitor->trace(m_objectSrc);
     visitor->trace(m_scriptSrc);
     visitor->trace(m_styleSrc);
 }
 
 
 } // namespace blink