mirror of
https://github.com/servo/servo.git
synced 2025-08-08 06:55:31 +01:00
net: Perform CSP checks on fetch responses. (#37154)
Also add clarifying comments to the SRI WPT tests with regards to the `www.` domain and how that interacts with the integrity checks. Lastly, adjust the casing for `Strict-Dynamic`, as in the post-request check that should also be case-insensitive. Closes servo/servo#37200 Closes servo/servo#36760 Fixes servo/servo#36499 Part of w3c/webappsec-csp#727 Fixes w3c/webappsec-csp#728 Part of servo/servo#4577 Signed-off-by: Josh Matthews <josh@joshmatthews.net> Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com> Co-authored-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Tim van der Lippe
GitHub
parent
ed888e284b
commit
f710e2cab4
18 changed files with 104 additions and 88 deletions
8
tests/wpt/meta/MANIFEST.json
vendored
8
tests/wpt/meta/MANIFEST.json
vendored
|
|
@ -397312,7 +397312,7 @@
|
|||
[]
|
||||
],
|
||||
"script-src-strict_dynamic_parser_inserted.html.headers": [
|
||||
"b7918c93323eff9db66ad26a73b78798d35e5f7b",
|
||||
"9d0b3b93d44db43be7d19c34483bc1e63ef777a0",
|
||||
[]
|
||||
],
|
||||
"script-src-strict_dynamic_parser_inserted_correct_nonce.html.headers": [
|
||||
|
|
@ -568648,7 +568648,7 @@
|
|||
]
|
||||
],
|
||||
"default-src-sri_hash.sub.html": [
|
||||
"87fce5961fd1854303377ee939b21b6275b312cf",
|
||||
"87389c306a53fdffa9806ba05f08a097713bcc37",
|
||||
[
|
||||
null,
|
||||
{}
|
||||
|
|
@ -573246,7 +573246,7 @@
|
|||
]
|
||||
],
|
||||
"script-src-sri_hash.sub.html": [
|
||||
"9216e2b0d4971fc46d0010e8dfa7375845187a8d",
|
||||
"e290911183d0b9a5dccf4a6a2eaa3b12ee25c682",
|
||||
[
|
||||
null,
|
||||
{}
|
||||
|
|
@ -573351,7 +573351,7 @@
|
|||
]
|
||||
],
|
||||
"script-src-strict_dynamic_parser_inserted.html": [
|
||||
"c5e33dc4253dbf3ce2b0c6cb2fca4b0306d68244",
|
||||
"9a8ad7a4ef2b5592af70d4dcc56f291e75da8e1b",
|
||||
[
|
||||
null,
|
||||
{}
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
[connect-src-syncxmlhttprequest-redirect-to-blocked.sub.html]
|
||||
[Expecting logs: ["PASS Sync XMLHttpRequest.send() did not follow the disallowed redirect.","TEST COMPLETE","violated-directive=connect-src"\]]
|
||||
expected: FAIL
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
[connect-src-xmlhttprequest-redirect-to-blocked.sub.html]
|
||||
[Expecting logs: ["PASS XMLHttpRequest.send() did not follow the disallowed redirect.","TEST COMPLETE","violated-directive=connect-src"\]]
|
||||
expected: FAIL
|
||||
|
|
@ -1,6 +1,3 @@
|
|||
[script-tag.http.html]
|
||||
[Content Security Policy: Expects blocked for script-tag to same-http origin and swap-origin redirection from http context.]
|
||||
expected: FAIL
|
||||
|
||||
[Content Security Policy: Expects blocked for script-tag to same-http origin and swap-origin redirection from http context.: securitypolicyviolation]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,6 +1,3 @@
|
|||
[script-tag.https.html]
|
||||
[Content Security Policy: Expects blocked for script-tag to same-https origin and swap-origin redirection from https context.]
|
||||
expected: FAIL
|
||||
|
||||
[Content Security Policy: Expects blocked for script-tag to same-https origin and swap-origin redirection from https context.: securitypolicyviolation]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,6 +1,3 @@
|
|||
[script-tag.http.html]
|
||||
[Content Security Policy: Expects blocked for script-tag to same-http origin and swap-origin redirection from http context.]
|
||||
expected: FAIL
|
||||
|
||||
[Content Security Policy: Expects blocked for script-tag to same-http origin and swap-origin redirection from http context.: securitypolicyviolation]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,6 +1,3 @@
|
|||
[script-tag.https.html]
|
||||
[Content Security Policy: Expects blocked for script-tag to same-https origin and swap-origin redirection from https context.]
|
||||
expected: FAIL
|
||||
|
||||
[Content Security Policy: Expects blocked for script-tag to same-https origin and swap-origin redirection from https context.: securitypolicyviolation]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
[wildcard-host-part.sub.window.html]
|
||||
expected: CRASH
|
||||
|
|
@ -1,7 +1,4 @@
|
|||
[dedicatedworker-connect-src.html]
|
||||
[Same-origin => cross-origin 'fetch()' in http: with connect-src 'self']
|
||||
expected: FAIL
|
||||
|
||||
[Reports match in http: with connect-src 'self']
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,3 @@
|
|||
[report-original-url.sub.html]
|
||||
expected: TIMEOUT
|
||||
[Block after redirect, same-origin = original URL in report]
|
||||
expected: TIMEOUT
|
||||
|
||||
[Block after redirect, cross-origin = original URL in report]
|
||||
expected: TIMEOUT
|
||||
|
||||
[Violation report status OK.]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
[img-src-redirect.sub.html]
|
||||
[The blocked URI in the security policy violation event should be the original URI before redirects.]
|
||||
expected: FAIL
|
||||
|
|
@ -7,6 +7,9 @@
|
|||
<script src='/resources/testharnessreport.js' nonce='dummy'></script>
|
||||
|
||||
<!-- CSP served: default-src {{domains[www]}}:* 'nonce-dummy' 'sha256-wIc3KtqOuTFEu6t17sIBuOswgkV406VJvhSk79Gw6U0=' 'ShA256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c=' 'sha512-rYCVMxWV5nq8IsMo+UZNObWtEiWGok/vDN8BMoEQi41s0znSes6E1Q2aag3Lw3u2J1w2rqH7uF2ws6FpQhfSOA=='; style-src 'unsafe-inline' -->
|
||||
<!-- The domain here is intentionally served with `www`. In the event that the integrity check fails,
|
||||
the request should be disallowed by the source list. If we were to use {{domains[]}},
|
||||
then we would not be able to observe the difference with regards to the integrity check -->
|
||||
<!-- ShA256 is intentionally mixed case -->
|
||||
</head>
|
||||
|
||||
|
|
@ -18,6 +21,8 @@
|
|||
var port = "{{ports[http][0]}}";
|
||||
if (location.protocol === "https:")
|
||||
port = "{{ports[https][0]}}";
|
||||
// Since {{domains[www]}} is allowed by the CSP policy, regardless of the integrity check
|
||||
// the request would be allowed.
|
||||
var crossorigin_base = location.protocol + "//{{domains[www]}}:" + port;
|
||||
|
||||
// Test name, src, integrity, expected to run.
|
||||
|
|
|
|||
|
|
@ -7,6 +7,9 @@
|
|||
<script src='/resources/testharnessreport.js' nonce='dummy'></script>
|
||||
|
||||
<!-- CSP served: script-src {{domains[www]}}:* 'nonce-dummy' 'sha256-wIc3KtqOuTFEu6t17sIBuOswgkV406VJvhSk79Gw6U0=' 'ShA256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c=' 'sha512-rYCVMxWV5nq8IsMo+UZNObWtEiWGok/vDN8BMoEQi41s0znSes6E1Q2aag3Lw3u2J1w2rqH7uF2ws6FpQhfSOA==' -->
|
||||
<!-- The domain here is intentionally served with `www`. In the event that the integrity check fails,
|
||||
the request should be disallowed by the source list. If we were to use {{domains[]}},
|
||||
then we would not be able to observe the difference with regards to the integrity check -->
|
||||
<!-- ShA256 is intentionally mixed case -->
|
||||
</head>
|
||||
|
||||
|
|
@ -18,6 +21,8 @@
|
|||
var port = "{{ports[http][0]}}";
|
||||
if (location.protocol === "https:")
|
||||
port = "{{ports[https][0]}}";
|
||||
// Since {{domains[www]}} is allowed by the CSP policy, regardless of the integrity check
|
||||
// the request would be allowed.
|
||||
var crossorigin_base = location.protocol + "//{{domains[www]}}:" + port;
|
||||
|
||||
// Test name, src, integrity, expected to run.
|
||||
|
|
|
|||
|
|
@ -2,11 +2,12 @@
|
|||
<html>
|
||||
|
||||
<head>
|
||||
<title>Parser-inserted scripts without a correct nonce are not allowed with `strict-dynamic` in the script-src directive.</title>
|
||||
<title>Parser-inserted scripts without a correct nonce are not allowed with `Strict-Dynamic` in the script-src directive.</title>
|
||||
<script src='/resources/testharness.js' nonce='dummy'></script>
|
||||
<script src='/resources/testharnessreport.js' nonce='dummy'></script>
|
||||
|
||||
<!-- CSP served: script-src 'strict-dynamic' 'nonce-dummy' -->
|
||||
<!-- CSP served: script-src 'Strict-Dynamic' 'nonce-dummy' -->
|
||||
<!-- Strict-Dynamic is intentionally mixed case -->
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@ Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
|||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Content-Security-Policy: script-src 'strict-dynamic' 'nonce-dummy'
|
||||
Content-Security-Policy: script-src 'Strict-Dynamic' 'nonce-dummy'
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue