CSP: Strip reported URLs for 'frame-src' and 'object-src'.

CSP: Strip reported URLs for 'frame-src' and 'object-src'.

The relaxation that landed in https://codereview.chromium.org/2002943002
was a bit too relaxed, and leaks navigation targets cross-origin for
'frame-src' and 'object-src' violations.

This patch reverts to the old behavior for those two directives.

BUG=633306
Committed: https://crrev.com/94a6ff53682eac87184c1682b63faf6110325174
Cr-Commit-Position: refs/heads/master@{#412809}

[Mike West, 2016-08-18 08:17:58]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-18 08:18:07]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2016-08-18 08:27:20]

mkwst@chromium.org changed reviewers:
+ estark@chromium.org

[Mike West, 2016-08-18 08:27:20]

Hey Emily! You reviewed the initial patch, and you're in a reasonable time zone
this week! Would you like to review this patch as well? :)

[estark, 2016-08-18 09:32:27]

lgtm

https://codereview.chromium.org/2255103002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp (right):

https://codereview.chromium.org/2255103002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp:803: return
SecurityOrigin::create(url)->toString();
Technically I think the old behavior was the full URL if it was same-origin, and
just the origin if it was cross-origin, wasn't it? So you could change this to

return document->getSecurityOrigin()->canRequest(url) ?
url.strippedForUseAsReferrer() : SecurityOrigin::create(url)->toString()

but I don't think it matters too much either way.

[commit-bot: I haz the power, 2016-08-18 09:43:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-18 09:43:18]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Mike West, 2016-08-18 09:55:35]

The CQ bit was unchecked by mkwst@chromium.org

[Mike West, 2016-08-18 09:56:18]

On 2016/08/18 at 09:32:27, estark wrote:
> lgtm
> 
>
https://codereview.chromium.org/2255103002/diff/1/third_party/WebKit/Source/c...
> File third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
(right):
> 
>
https://codereview.chromium.org/2255103002/diff/1/third_party/WebKit/Source/c...
> third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp:803: return
SecurityOrigin::create(url)->toString();
> Technically I think the old behavior was the full URL if it was same-origin,
and just the origin if it was cross-origin, wasn't it? So you could change this
to
> 
> return document->getSecurityOrigin()->canRequest(url) ?
url.strippedForUseAsReferrer() : SecurityOrigin::create(url)->toString()
> 
> but I don't think it matters too much either way.

You're right, fixed!

Thanks!

[Mike West, 2016-08-18 09:56:22]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2016-08-18 09:56:23]

The patchset sent to the CQ was uploaded after l-g-t-m from estark@chromium.org
Link to the patchset: https://codereview.chromium.org/2255103002/#ps20001
(title: "estark")

[commit-bot: I haz the power, 2016-08-18 09:56:37]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-18 13:18:31]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-08-18 13:20:35]

Description was changed from

==========
CSP: Strip reported URLs for 'frame-src' and 'object-src'.

The relaxation that landed in https://codereview.chromium.org/2002943002
was a bit too relaxed, and leaks navigation targets cross-origin for
'frame-src' and 'object-src' violations.

This patch reverts to the old behavior for those two directives.

BUG=633306
==========

to

==========
CSP: Strip reported URLs for 'frame-src' and 'object-src'.

The relaxation that landed in https://codereview.chromium.org/2002943002
was a bit too relaxed, and leaks navigation targets cross-origin for
'frame-src' and 'object-src' violations.

This patch reverts to the old behavior for those two directives.

BUG=633306

Committed: https://crrev.com/94a6ff53682eac87184c1682b63faf6110325174
Cr-Commit-Position: refs/heads/master@{#412809}
==========

[commit-bot: I haz the power, 2016-08-18 13:20:36]

Patchset 2 (id:??) landed as
https://crrev.com/94a6ff53682eac87184c1682b63faf6110325174
Cr-Commit-Position: refs/heads/master@{#412809}