CSP: Allow secure upgrade from an explicitly insecure expression.

content/common/content_security_policy/csp_source.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/common/content_security_policy/csp_context.h"
 #include "url/url_canon.h"
 #include "url/url_util.h"
 
 namespace content {
 
 namespace {
 
 bool DecodePath(const base::StringPiece& path, std::string* output) {
   url::RawCanonOutputT<base::char16> unescaped;
   url::DecodeURLEscapeSequences(path.data(), path.size(), &unescaped);
   return base::UTF16ToUTF8(unescaped.data(), unescaped.length(), output);
 }
 
-int DefaultPortForScheme(const std::string& scheme) {
+int DefaultPortForScheme(const base::StringPiece& scheme) {
   return url::DefaultPortForScheme(scheme.data(), scheme.size());
 }
 
 bool SourceAllowScheme(const CSPSource& source,
-                       const GURL& url,
+                       const base::StringPiece& scheme,
                        CSPContext* context) {
-  if (source.scheme.empty())
-    return context->ProtocolMatchesSelf(url);
-  if (source.scheme == url::kHttpScheme)
-    return url.SchemeIsHTTPOrHTTPS();
-  if (source.scheme == url::kWsScheme)
-    return url.SchemeIsWSOrWSS();
-  return url.SchemeIs(source.scheme);
+  const std::string& source_scheme =
+      source.scheme.empty() ? context->GetSelfScheme() : source.scheme;
+
+  return (scheme == source_scheme) ||
+         (source_scheme == url::kHttpScheme &&
+          scheme == url::kHttpSuboriginScheme) ||
+         (source_scheme == url::kHttpsScheme &&
+          scheme == url::kHttpsSuboriginScheme);
 }
 
 bool SourceAllowHost(const CSPSource& source, const GURL& url) {
   if (source.is_host_wildcard) {
     if (source.host.empty())
       return true;
     // TODO(arthursonzogni): Chrome used to, incorrectly, match *.x.y to x.y.
     // The renderer version of this function count how many times it happens.
     // It might be useful to do it outside of blink too.
     // See third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
     return base::EndsWith(url.host(), '.' + source.host,
                           base::CompareCase::INSENSITIVE_ASCII);
   } else
     return url.host() == source.host;
 }
 
-bool SourceAllowPort(const CSPSource& source, const GURL& url) {
-  int url_port = url.EffectiveIntPort();
-
+bool SourceAllowPort(const CSPSource& source,
+                     const base::StringPiece& scheme,
+                     int port) {
   if (source.is_port_wildcard)
     return true;
 
   if (source.port == url::PORT_UNSPECIFIED)
-    return DefaultPortForScheme(url.scheme()) == url_port;
+    return DefaultPortForScheme(scheme) == port;
 
-  if (source.port == url_port)
-    return true;
-
-  if (source.port == 80 && url_port == 443)
+  if (source.port == port)
     return true;
 
   return false;
 }
 
 bool SourceAllowPath(const CSPSource& source,
                      const GURL& url,
                      bool is_redirect) {
   if (is_redirect)
     return true;
@@ skipping 10 matching lines @@
 
   // If the path represents a directory.
   if (base::EndsWith(source.path, "/", base::CompareCase::SENSITIVE))
     return base::StartsWith(url_path, source.path,
                             base::CompareCase::SENSITIVE);
 
   // The path represents a file.
   return source.path == url_path;
 }
 
+bool AllowInternal(const CSPSource& source,
+                   const GURL& url,
+                   const base::StringPiece& scheme,
+                   int port,
+                   CSPContext* context,
+                   bool is_redirect) {
+  if (source.IsSchemeOnly())
+    return SourceAllowScheme(source, scheme, context);
+
+  return SourceAllowScheme(source, scheme, context) &&
+         SourceAllowHost(source, url) &&
+         SourceAllowPort(source, scheme, port) &&
+         SourceAllowPath(source, url, is_redirect);
+}
+
 }  // namespace
 
 CSPSource::CSPSource()
     : scheme(),
       host(),
       is_host_wildcard(false),
       port(url::PORT_UNSPECIFIED),
       is_port_wildcard(false),
       path() {}
 
@@ skipping 15 matching lines @@
 }
 
 CSPSource::CSPSource(const CSPSource& source) = default;
 CSPSource::~CSPSource() = default;
 
 // static
 bool CSPSource::Allow(const CSPSource& source,
                       const GURL& url,
                       CSPContext* context,
                       bool is_redirect) {
-  if (source.IsSchemeOnly())
-    return SourceAllowScheme(source, url, context);
+  base::StringPiece scheme = url.scheme_piece();
+  int port = url.EffectiveIntPort();
 
-  return SourceAllowScheme(source, url, context) &&
-         SourceAllowHost(source, url) && SourceAllowPort(source, url) &&
-         SourceAllowPath(source, url, is_redirect);
+  if (AllowInternal(source, url, scheme, port, context, is_redirect))
+    return true;
+
+  // A secure upgrade from an explicitly insecure expression is always allowed.
+  const struct {
+    std::string insecure_scheme;
+    std::string secure_scheme;
+    int insecure_port;
+    int secure_port;
+  } kUpgrade[] = {
+      {url::kHttpScheme, url::kHttpsScheme, 80, 443},
+      {url::kHttpSuboriginScheme, url::kHttpsSuboriginScheme, 80, 443},
+      {url::kWsScheme, url::kWssScheme, 80, 443},
+  };
+  for (const auto& upgrade : kUpgrade) {
+    if (scheme == upgrade.secure_scheme && port == upgrade.secure_port) {
+      return AllowInternal(source, url, upgrade.insecure_scheme,
+                           upgrade.insecure_port, context, is_redirect);
+    }
+  }
+
+  return false;
 }
 
 std::string CSPSource::ToString() const {
   // scheme
   if (IsSchemeOnly())
     return scheme + ":";
 
   std::stringstream text;
   if (!scheme.empty())
     text << scheme << "://";
@@ skipping 30 matching lines @@
 
 bool CSPSource::HasHost() const {
   return !host.empty() || is_host_wildcard;
 }
 
 bool CSPSource::HasPath() const {
   return !path.empty();
 }
 
 }  // namespace content