Changeset 286860 in webkit for trunk/Source/WebCore/dom/Element.cpp

Timestamp:

Dec 10, 2021, 11:00:44 AM (3 years ago)

Author:

Patrick Griffis

Message:

LayoutTests/imported/w3c:
CSP: Implement protections against nonce-hijacking
​https://bugs.webkit.org/show_bug.cgi?id=233087

Reviewed by Brent Fulgham.

Update expectations.

• web-platform-tests/content-security-policy/script-src/nonce-enforce-blocked-expected.txt:

Source/WebCore:
CSP: Prevent nonce-hijacking
​https://bugs.webkit.org/show_bug.cgi?id=233087

Reviewed by Brent Fulgham.

Implement protections against nonce-hijacking as described in this spec:

​https://www.w3.org/TR/CSP3/#security-nonce-hijacking

• dom/Element.cpp:

(WebCore::Element::isNonceable const):
(WebCore::Element::nonce const):

• dom/Element.h:

(WebCore::Element::hasDuplicateAttribute const):
(WebCore::Element::setHasDuplicateAttribute):

• html/parser/AtomHTMLToken.h:

(WebCore::AtomHTMLToken::hasDuplicateAttribute const):
(WebCore::AtomHTMLToken::initializeAttributes):

• html/parser/HTMLConstructionSite.cpp:

(WebCore::setAttributes):
(WebCore::HTMLConstructionSite::insertCustomElement):

File:

• trunk/Source/WebCore/dom/Element.cpp (modified) (3 diffs)

trunk/Source/WebCore/dom/Element.cpp

@@ -75 +75 @@
 #include "HTMLOptionElement.h"
 #include "HTMLParserIdioms.h"
+#include "HTMLScriptElement.h"
 #include "HTMLSelectElement.h"
 #include "HTMLTemplateElement.h"
@@ -110 +111 @@
 #include "SVGNames.h"
 #include "SVGSVGElement.h"
+#include "SVGScriptElement.h"
 #include "ScriptDisallowedScope.h"
 #include "ScrollIntoViewOptions.h"
@@ -319 +321 @@
 }
 
+bool Element::isNonceable() const
+{
+    // https://www.w3.org/TR/CSP3/#is-element-nonceable
+    if (elementRareData()->nonce().isNull())
+        return false;
+
+    if (hasDuplicateAttribute())
+        return false;
+
+    if (hasAttributes()
+        && (is<HTMLScriptElement>(*this) || is<SVGScriptElement>(*this))) {
+        static const char scriptString[] = "<script";
+        static const char styleString[] = "<style";
+
+        for (const auto& attribute : attributesIterator()) {
+            auto name = attribute.localName().convertToASCIILowercase();
+            auto value = attribute.value().convertToASCIILowercase();
+            if (name.contains(scriptString)
+                || name.contains(styleString)
+                || value.contains(scriptString)
+                || value.contains(styleString))
+                return false;
+        }
+    }
+
+    return true;
+}
+
 const AtomString& Element::nonce() const
 {
-    return hasRareData() ? elementRareData()->nonce() : emptyAtom();
+    if (hasRareData() && isNonceable())
+        return elementRareData()->nonce();
+
+    return emptyAtom();
 }