Switch to the sha2 crate for SRI digests.

This removes one (simple) use of OpenSSL

Cargo.lock

@@ -961,13 +961,13 @@ dependencies = [
 
 [[package]]
 name = "content-security-policy"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ea9f813e3c5ece60232e2b5d0d8187d310bf1e5641c5457e54099780a892a8"
+checksum = "1780f19455c4d346013dc4fb3e9c329c64c7c300b0ebeff786743f4b9f34ec0e"
 dependencies = [
- "base64 0.12.0",
+ "base64 0.13.0",
  "bitflags",
- "lazy_static",
+ "once_cell",
  "percent-encoding",
  "regex",
  "serde",
@@ -1410,9 +1410,9 @@ dependencies = [
 
 [[package]]
 name = "digest"
-version = "0.10.3"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2fb860ca6fafa5552fb6d0e816a69c8e49f0908bf524e30a90d97c85892d506"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
 dependencies = [
  "block-buffer 0.10.2",
  "crypto-common",
@@ -3995,6 +3995,7 @@ dependencies = [
  "flate2",
  "futures 0.3.5",
  "futures-util",
+ "generic-array 0.14.4",
  "headers",
  "http",
  "hyper 0.14.5",
@@ -4023,6 +4024,7 @@ dependencies = [
  "servo_arc",
  "servo_config",
  "servo_url",
+ "sha2",
  "std_test_override",
  "time",
  "tokio 0.2.24",
@@ -5948,19 +5950,18 @@ checksum = "028f48d513f9678cda28f6e4064755b3fbb2af6acd672f2c209b62323f7aea0f"
 dependencies = [
  "cfg-if 1.0.0",
  "cpufeatures",
- "digest 0.10.3",
+ "digest 0.10.6",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.8.1"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27044adfd2e1f077f649f59deb9490d3941d674002f7d062870a60ebe9bd47a0"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
 dependencies = [
- "block-buffer 0.7.3",
+ "cfg-if 1.0.0",
- "digest 0.8.1",
+ "cpufeatures",
- "fake-simd",
+ "digest 0.10.6",
- "opaque-debug 0.2.3",
 ]
 
 [[package]]

components/malloc_size_of/Cargo.toml

@@ -30,7 +30,7 @@ servo = [
 [dependencies]
 accountable-refcell = { version = "0.2.0", optional = true }
 app_units = "0.7"
-content-security-policy = { version = "0.4.0", features = ["serde"], optional = true }
+content-security-policy = { version = "0.5", features = ["serde"], optional = true }
 crossbeam-channel = { version = "0.4", optional = true }
 cssparser = "0.29"
 euclid = "0.22"

components/net/Cargo.toml

@@ -20,7 +20,7 @@ async-tungstenite = { version = "0.9", features = ["tokio-openssl"] }
 base64 = "0.10.1"
 brotli = "3"
 bytes = "1"
-content-security-policy = { version = "0.4.0", features = ["serde"] }
+content-security-policy = { version = "0.5", features = ["serde"] }
 cookie_rs = { package = "cookie", version = "0.12" }
 crossbeam-channel = "0.4"
 data-url = "0.1.0"
@@ -29,6 +29,7 @@ embedder_traits = { path = "../embedder_traits" }
 flate2 = "1"
 futures = { version = "0.3", package = "futures" }
 futures-util = { version  = "0.3" }
+generic-array = "0.14"
 headers = "0.3"
 http = "0.2"
 hyper = { version = "0.14", features = ["client", "http1", "http2", "tcp", "stream"] }
@@ -57,6 +58,7 @@ servo_allocator = { path = "../allocator" }
 servo_arc = { path = "../servo_arc" }
 servo_config = { path = "../config" }
 servo_url = { path = "../url" }
+sha2 = "0.10"
 time = "0.1.41"
 tokio = { version = "1", package = "tokio", features = ["sync", "macros", "rt-multi-thread"] }
 tokio2 = { version = "0.2", package = "tokio", features = ["sync", "macros", "rt-threaded", "tcp"] }

components/net/subresource_integrity.rs

@@ -3,8 +3,9 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use base64;
+use generic_array::ArrayLength;
 use net_traits::response::{Response, ResponseBody, ResponseType};
-use openssl::hash::{hash, MessageDigest};
+use sha2::{Digest, Sha256, Sha384, Sha512};
 use std::iter::Filter;
 use std::str::Split;
 use std::sync::MutexGuard;
@@ -115,12 +116,13 @@ pub fn get_strongest_metadata(integrity_metadata_list: Vec<SriEntry>) -> Vec<Sri
 }
 
 /// <https://w3c.github.io/webappsec-subresource-integrity/#apply-algorithm-to-response>
-fn apply_algorithm_to_response(
+fn apply_algorithm_to_response<S: ArrayLength<u8>, D: Digest<OutputSize = S>>(
     body: MutexGuard<ResponseBody>,
-    message_digest: MessageDigest,
+    mut hasher: D,
 ) -> String {
     if let ResponseBody::Done(ref vec) = *body {
-        let response_digest = hash(message_digest, vec).unwrap(); //Now hash
+        hasher.update(vec);
+        let response_digest = hasher.finalize(); //Now hash
         base64::encode(&response_digest)
     } else {
         unreachable!("Tried to calculate digest of incomplete response body")
@@ -156,14 +158,14 @@ pub fn is_response_integrity_valid(integrity_metadata: &str, response: &Response
         let algorithm = item.alg;
         let digest = item.val;
 
-        let message_digest = match &*algorithm {
+        let hashed = match &*algorithm {
-            "sha256" => MessageDigest::sha256(),
+            "sha256" => apply_algorithm_to_response(body, Sha256::new()),
-            "sha384" => MessageDigest::sha384(),
+            "sha384" => apply_algorithm_to_response(body, Sha384::new()),
-            "sha512" => MessageDigest::sha512(),
+            "sha512" => apply_algorithm_to_response(body, Sha512::new()),
             _ => continue,
         };
 
-        if apply_algorithm_to_response(body, message_digest) == digest {
+        if hashed == digest {
             return true;
         }
     }

components/net_traits/Cargo.toml

@@ -13,7 +13,7 @@ test = false
 doctest = false
 
 [dependencies]
-content-security-policy = { version = "0.4.0", features = ["serde"] }
+content-security-policy = { version = "0.5", features = ["serde"] }
 cookie = "0.12"
 embedder_traits = { path = "../embedder_traits" }
 headers = "0.3"

components/script/Cargo.toml

@@ -39,7 +39,7 @@ bitflags = "1.0"
 bluetooth_traits = { path = "../bluetooth_traits" }
 canvas_traits = { path = "../canvas_traits" }
 chrono = "0.4"
-content-security-policy = { version = "0.4.0", features = ["serde"] }
+content-security-policy = { version = "0.5", features = ["serde"] }
 cookie = "0.12"
 crossbeam-channel = "0.4"
 cssparser = "0.29"