| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
| 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 14 matching lines...) Expand all Loading... |
| 25 */ | 25 */ |
| 26 | 26 |
| 27 #include "config.h" | 27 #include "config.h" |
| 28 #include "core/html/parser/XSSAuditor.h" | 28 #include "core/html/parser/XSSAuditor.h" |
| 29 | 29 |
| 30 #include "core/HTMLNames.h" | 30 #include "core/HTMLNames.h" |
| 31 #include "core/SVGNames.h" | 31 #include "core/SVGNames.h" |
| 32 #include "core/XLinkNames.h" | 32 #include "core/XLinkNames.h" |
| 33 #include "core/dom/Document.h" | 33 #include "core/dom/Document.h" |
| 34 #include "core/frame/LocalFrame.h" | 34 #include "core/frame/LocalFrame.h" |
| 35 #include "core/frame/Settings.h" |
| 35 #include "core/frame/csp/ContentSecurityPolicy.h" | 36 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 36 #include "core/html/HTMLParamElement.h" | 37 #include "core/html/HTMLParamElement.h" |
| 37 #include "core/html/parser/HTMLDocumentParser.h" | 38 #include "core/html/parser/HTMLDocumentParser.h" |
| 38 #include "core/html/parser/HTMLParserIdioms.h" | 39 #include "core/html/parser/HTMLParserIdioms.h" |
| 39 #include "core/html/parser/TextResourceDecoder.h" | 40 #include "core/html/parser/TextResourceDecoder.h" |
| 40 #include "core/html/parser/XSSAuditorDelegate.h" | 41 #include "core/html/parser/XSSAuditorDelegate.h" |
| 42 #include "core/inspector/ConsoleMessage.h" |
| 41 #include "core/loader/DocumentLoader.h" | 43 #include "core/loader/DocumentLoader.h" |
| 42 #include "core/frame/Settings.h" | |
| 43 #include "platform/JSONValues.h" | 44 #include "platform/JSONValues.h" |
| 44 #include "platform/network/FormData.h" | 45 #include "platform/network/FormData.h" |
| 45 #include "platform/text/DecodeEscapeSequences.h" | 46 #include "platform/text/DecodeEscapeSequences.h" |
| 46 #include "wtf/ASCIICType.h" | 47 #include "wtf/ASCIICType.h" |
| 47 #include "wtf/MainThread.h" | 48 #include "wtf/MainThread.h" |
| 48 | 49 |
| 49 namespace { | 50 namespace { |
| 50 | 51 |
| 51 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. | 52 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. |
| 52 const char kURLWithUniqueOrigin[] = "data:,"; | 53 const char kURLWithUniqueOrigin[] = "data:,"; |
| (...skipping 285 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 338 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; | 339 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; |
| 339 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { | 340 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { |
| 340 xssProtectionReportURL = document->completeURL(reportURL); | 341 xssProtectionReportURL = document->completeURL(reportURL); |
| 341 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { | 342 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { |
| 342 errorDetails = "insecure reporting URL for secure page"; | 343 errorDetails = "insecure reporting URL for secure page"; |
| 343 xssProtectionHeader = ReflectedXSSInvalid; | 344 xssProtectionHeader = ReflectedXSSInvalid; |
| 344 xssProtectionReportURL = KURL(); | 345 xssProtectionReportURL = KURL(); |
| 345 } | 346 } |
| 346 } | 347 } |
| 347 if (xssProtectionHeader == ReflectedXSSInvalid) | 348 if (xssProtectionHeader == ReflectedXSSInvalid) |
| 348 document->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel
, "Error parsing header X-XSS-Protection: " + headerValue + ": " + errorDetails
+ " at character position " + String::format("%u", errorPosition) + ". The defa
ult protections will be applied."); | 349 document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSo
urce, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue
+ ": " + errorDetails + " at character position " + String::format("%u", error
Position) + ". The default protections will be applied.")); |
| 349 | 350 |
| 350 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); | 351 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); |
| 351 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; | 352 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; |
| 352 | 353 |
| 353 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); | 354 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); |
| 354 // FIXME: Combine the two report URLs in some reasonable way. | 355 // FIXME: Combine the two report URLs in some reasonable way. |
| 355 if (auditorDelegate) | 356 if (auditorDelegate) |
| 356 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); | 357 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); |
| 357 | 358 |
| 358 FormData* httpBody = documentLoader->request().httpBody(); | 359 FormData* httpBody = documentLoader->request().httpBody(); |
| (...skipping 445 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 804 | 805 |
| 805 bool XSSAuditor::isSafeToSendToAnotherThread() const | 806 bool XSSAuditor::isSafeToSendToAnotherThread() const |
| 806 { | 807 { |
| 807 return m_documentURL.isSafeToSendToAnotherThread() | 808 return m_documentURL.isSafeToSendToAnotherThread() |
| 808 && m_decodedURL.isSafeToSendToAnotherThread() | 809 && m_decodedURL.isSafeToSendToAnotherThread() |
| 809 && m_decodedHTTPBody.isSafeToSendToAnotherThread() | 810 && m_decodedHTTPBody.isSafeToSendToAnotherThread() |
| 810 && m_httpBodyAsString.isSafeToSendToAnotherThread(); | 811 && m_httpBodyAsString.isSafeToSendToAnotherThread(); |
| 811 } | 812 } |
| 812 | 813 |
| 813 } // namespace blink | 814 } // namespace blink |
| OLD | NEW |