source: webkit/trunk/Source/WebCore/loader/ThreadableLoader.h

Last change on this file was 288701, checked in by Kate Cheney, 3 years ago

"Unrecognized Content-Security-Policy directive 'worker-src'."
https://bugs.webkit.org/show_bug.cgi?id=235260
<rdar://problem/83734079>

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

  • web-platform-tests/content-security-policy/child-src/child-src-cross-origin-load.sub-expected.txt:
  • web-platform-tests/content-security-policy/child-src/child-src-worker-blocked.sub-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-classic.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-classic.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-module.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-module.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-classic.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-classic.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-module.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-module.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-self/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-self/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-self/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-self/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/dedicated-fallback.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/dedicated-none.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback-blocked.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/service-none.https.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/service-worker-src-child-fallback-blocked.https.sub-expected.txt:
  • web-platform-tests/content-security-policy/worker-src/shared-child.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-fallback.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-list.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-none.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-self.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-worker-src-child-fallback-blocked.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub-expected.txt: Added.
  • web-platform-tests/content-security-policy/blob/self-doesnt-match-blob.sub-expected.txt:
  • web-platform-tests/content-security-policy/blob/star-doesnt-match-blob.sub-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-classic.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-classic.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-module.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-module.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-classic.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-classic.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-module.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-module.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/sharedworker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/sharedworker-import-data.https-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/worker-import-data.http-expected.txt:
  • web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/worker-import-data.https-expected.txt:

Source/WebCore:

Implementation of worker-src directive. According to https://www.w3.org/TR/CSP3/#changes-from-level-2
the worker-src directive now restricts URLs that can be loaded by
workers, and defers to child-src if not specified.

  • bindings/js/WorkerModuleScriptLoader.cpp:

(WebCore::WorkerModuleScriptLoader::load):
Check worker-src instead of child-src for worker loads.

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):

  • loader/ThreadableLoader.h:

Check worker-src instead of child-src for worker loads.

  • page/csp/ContentSecurityPolicy.cpp:

We can remove allowChildContextFromSource which is now fully replaced
by allowWorkerFromSource.

(WebCore::ContentSecurityPolicy::allowWorkerFromSource const):
(WebCore::ContentSecurityPolicy::allowChildContextFromSource const): Deleted.

  • page/csp/ContentSecurityPolicy.h:
  • page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::operativeDirectiveForWorkerSrc const):
worker-src defers to child-src, then script-src, then default-src.

(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForWorker):
(WebCore::ContentSecurityPolicyDirectiveList::addDirective):

  • page/csp/ContentSecurityPolicyDirectiveList.h:
  • page/csp/ContentSecurityPolicyDirectiveNames.cpp:
  • page/csp/ContentSecurityPolicyDirectiveNames.h:
  • workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL):

  • workers/AbstractWorker.h:

We check LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy
in allowWorkerFromSource, so we don't need to check in in AbstractWorker::resolveURL
anymore. We can also replace the child-src checks with worker-src
ones.

  • workers/Worker.cpp:

(WebCore::Worker::create):

  • workers/WorkerFontLoadRequest.cpp:

(WebCore::WorkerFontLoadRequest::load):

  • workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::addRegistration):
Block service worker registrations not specified by worker-src.

  • workers/shared/SharedWorker.cpp:

(WebCore::SharedWorker::create):
Block shared worker urls not specified by worker-src.

  • workers/shared/SharedWorkerScriptLoader.cpp:

(WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):

Source/WebKit:

  • NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):

LayoutTests:

Update tests now that worker-src defaults eventually to script-src.
Since this was not the case with child-src, legacy CSP tests do not
expect script-src policies to affect workers. We can fix this by
specifying a separate worker-src policy for these tests to maintain
behavior.

Some wpt tests log random URL strings that change for every test
iteration. For now we can't unskip those.

  • http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp.html:
  • http/tests/security/contentSecurityPolicy/worker-script-src.html:
  • http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html:
  • http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html:
  • http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html:
  • http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html:
  • Property svn:eol-style set to native
File size: 3.9 KB
Line 
1/*
2 * Copyright (C) 2009 Google Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are
6 * met:
7 *
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above
11 * copyright notice, this list of conditions and the following disclaimer
12 * in the documentation and/or other materials provided with the
13 * distribution.
14 * * Neither the name of Google Inc. nor the names of its
15 * contributors may be used to endorse or promote products derived from
16 * this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31#pragma once
32
33#include "ResourceLoaderOptions.h"
34#include <wtf/Noncopyable.h>
35#include <wtf/RefPtr.h>
36#include <wtf/text/AtomString.h>
37
38namespace WebCore {
39
40 class ResourceError;
41 class ResourceRequest;
42 class ResourceResponse;
43 class ScriptExecutionContext;
44 class ThreadableLoaderClient;
45
46 enum class ContentSecurityPolicyEnforcement {
47 DoNotEnforce,
48 EnforceWorkerSrcDirective,
49 EnforceConnectSrcDirective,
50 EnforceScriptSrcDirective,
51 };
52
53 enum class ResponseFilteringPolicy {
54 Enable,
55 Disable,
56 };
57
58 struct ThreadableLoaderOptions : ResourceLoaderOptions {
59 ThreadableLoaderOptions();
60 explicit ThreadableLoaderOptions(FetchOptions&&);
61 ThreadableLoaderOptions(const ResourceLoaderOptions&, ContentSecurityPolicyEnforcement, String&& initiator, ResponseFilteringPolicy);
62 ~ThreadableLoaderOptions();
63
64 ThreadableLoaderOptions isolatedCopy() const;
65
66 ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement { ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective };
67 String initiator; // This cannot be an AtomString, as isolatedCopy() wouldn't create an object that's safe for passing to another thread.
68 ResponseFilteringPolicy filteringPolicy { ResponseFilteringPolicy::Disable };
69 };
70
71 // Useful for doing loader operations from any thread (not threadsafe,
72 // just able to run on threads other than the main thread).
73 class ThreadableLoader {
74 WTF_MAKE_NONCOPYABLE(ThreadableLoader);
75 public:
76 static void loadResourceSynchronously(ScriptExecutionContext&, ResourceRequest&&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
77 static RefPtr<ThreadableLoader> create(ScriptExecutionContext&, ThreadableLoaderClient&, ResourceRequest&&, const ThreadableLoaderOptions&, String&& referrer = String(), String&& taskMode = { });
78
79 virtual void computeIsDone() = 0;
80 virtual void cancel() = 0;
81 void ref() { refThreadableLoader(); }
82 void deref() { derefThreadableLoader(); }
83
84 static void logError(ScriptExecutionContext&, const ResourceError&, const String&);
85
86 protected:
87 ThreadableLoader() = default;
88 virtual ~ThreadableLoader() = default;
89 virtual void refThreadableLoader() = 0;
90 virtual void derefThreadableLoader() = 0;
91 };
92
93} // namespace WebCore
Note: See TracBrowser for help on using the repository browser.