mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Backed out changeset 70ccfda99dbc::ca6ae38c0432 (bug 1302667) for frequently failing mochitest in security/test/csp/test_worker_src.html r=backout a=backout on a CLOSED TREE 

Backed out changeset ca6ae38c0432 (bug 1302667)
Backed out changeset ff86e185e09d (bug 1302667)
Backed out changeset 8ec6b8bf8c6c (bug 1302667)
Backed out changeset 21c73f9d8fac (bug 1302667)
Backed out changeset e982481dbf2c (bug 1302667)
Backed out changeset 70ccfda99dbc (bug 1302667)
This commit is contained in:
Coroiu Cristina 2017-10-30 14:19:29 +02:00
Родитель 302c4b5c31
Коммит 44d1b50592
26 изменённых файлов: 68 добавлений и 469 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

1
dom/interfaces/security/nsIContentSecurityPolicy.idl
Просмотреть файл

@ -63,7 +63,6 @@ interface nsIContentSecurityPolicy : nsISerializable
const unsigned short BLOCK_ALL_MIXED_CONTENT = 19;
const unsigned short REQUIRE_SRI_FOR = 20;
const unsigned short SANDBOX_DIRECTIVE = 21;
const unsigned short WORKER_SRC_DIRECTIVE = 22;
/**
* Accessor method for a read-only string version of the policy at a given

7
dom/locales/en-US/chrome/security/csp.properties
Просмотреть файл

@ -112,10 +112,9 @@ couldntParsePort = Couldn’t parse port in %1$S
# LOCALIZATION NOTE (duplicateDirective):
# %1$S is the name of the duplicate directive
duplicateDirective = Duplicate %1$S directives detected. All but the first instance will be ignored.
# LOCALIZATION NOTE (deprecatedChildSrcDirective):
# %1$S is the value of the deprecated directive.
# Do not localize: worker-src, frame-src
deprecatedChildSrcDirective = Directive ‘%1$S’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
# LOCALIZATION NOTE (deprecatedDirective):
# %1$S is the name of the deprecated directive, %2$S is the name of the replacement.
deprecatedDirective = Directive ‘%1$S’ has been deprecated. Please use directive ‘%2$S’ instead.
# LOCALIZATION NOTE (couldntParseInvalidSandboxFlag):
# %1$S is the option that could not be understood
couldntParseInvalidSandboxFlag = Couldn’t parse invalid sandbox flag ‘%1$S’

47
dom/security/nsCSPParser.cpp
Просмотреть файл

@ -134,8 +134,6 @@ nsCSPParser::nsCSPParser(cspTokens& aTokens,
, mUnsafeInlineKeywordSrc(nullptr)
, mChildSrc(nullptr)
, mFrameSrc(nullptr)
, mWorkerSrc(nullptr)
, mScriptSrc(nullptr)
, mParsingFrameAncestorsDir(false)
, mTokens(aTokens)
, mSelfURI(aSelfURI)
@ -1112,37 +1110,21 @@ nsCSPParser::directiveName()
return new nsUpgradeInsecureDirective(CSP_StringToCSPDirective(mCurToken));
}
// child-src by itself is deprecatd but will be enforced
// * for workers (if worker-src is not explicitly specified)
// * for frames (if frame-src is not explicitly specified)
// child-src has it's own class to handle frame-src if necessary
if (CSP_IsDirective(mCurToken, nsIContentSecurityPolicy::CHILD_SRC_DIRECTIVE)) {
const char16_t* params[] = { mCurToken.get() };
logWarningErrorToConsole(nsIScriptError::warningFlag,
"deprecatedChildSrcDirective",
params, ArrayLength(params));
mChildSrc = new nsCSPChildSrcDirective(CSP_StringToCSPDirective(mCurToken));
return mChildSrc;
}
// if we have a frame-src, cache it so we can discard child-src for frames
// if we have a frame-src, cache it so we can decide whether to use child-src
if (CSP_IsDirective(mCurToken, nsIContentSecurityPolicy::FRAME_SRC_DIRECTIVE)) {
const char16_t* params[] = { mCurToken.get(), u"child-src" };
logWarningErrorToConsole(nsIScriptError::warningFlag, "deprecatedDirective",
params, ArrayLength(params));
mFrameSrc = new nsCSPDirective(CSP_StringToCSPDirective(mCurToken));
return mFrameSrc;
}
// if we have a worker-src, cache it so we can discard child-src for workers
if (CSP_IsDirective(mCurToken, nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE)) {
mWorkerSrc = new nsCSPDirective(CSP_StringToCSPDirective(mCurToken));
return mWorkerSrc;
}
// if we have a script-src, cache it as a fallback for worker-src
// in case child-src is not present
if (CSP_IsDirective(mCurToken, nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE)) {
mScriptSrc = new nsCSPScriptSrcDirective(CSP_StringToCSPDirective(mCurToken));
return mScriptSrc;
}
if (CSP_IsDirective(mCurToken, nsIContentSecurityPolicy::REQUIRE_SRI_FOR)) {
return new nsRequireSRIForDirective(CSP_StringToCSPDirective(mCurToken));
}
@ -1319,22 +1301,9 @@ nsCSPParser::policy()
directive();
}
if (mChildSrc) {
if (!mFrameSrc) {
// if frame-src is specified explicitly for that policy than child-src should
// not restrict frames; if not, than child-src needs to restrict frames.
mChildSrc->setRestrictFrames();
}
if (!mWorkerSrc) {
// if worker-src is specified explicitly for that policy than child-src should
// not restrict workers; if not, than child-src needs to restrict workers.
mChildSrc->setRestrictWorkers();
}
}
// if script-src is specified, but not worker-src and also no child-src, then
// script-src has to govern workers.
if (mScriptSrc && !mWorkerSrc && !mChildSrc) {
mScriptSrc->setRestrictWorkers();
if (mChildSrc && !mFrameSrc) {
// if we have a child-src, it handles frame-src too, unless frame-src is set
mChildSrc->setHandleFrameSrc();
}
return mPolicy;

19
dom/security/nsCSPParser.h
Просмотреть файл

@ -242,17 +242,14 @@ class nsCSPParser {
bool mStrictDynamic; // false, if 'strict-dynamic' is not defined
nsCSPKeywordSrc* mUnsafeInlineKeywordSrc; // null, otherwise invlidate()
// cache variables for child-src, frame-src and worker-src handling;
// in CSP 3 child-src is deprecated. For backwards compatibility
// child-src needs to restrict:
// (*) frames, in case frame-src is not expicitly specified
// (*) workers, in case worker-src is not expicitly specified
// If neither worker-src, nor child-src is present, then script-src
// needs to govern workers.
nsCSPChildSrcDirective* mChildSrc;
nsCSPDirective* mFrameSrc;
nsCSPDirective* mWorkerSrc;
nsCSPScriptSrcDirective* mScriptSrc;
// cache variables for child-src and frame-src directive handling.
// frame-src is deprecated in favor of child-src, however if we
// see a frame-src directive, it takes precedence for frames and iframes.
// At the end of parsing, if we have a child-src directive, we need to
// decide whether it will handle frames, or if there is a frame-src we
// should honor instead.
nsCSPChildSrcDirective* mChildSrc;
nsCSPDirective* mFrameSrc;
// cache variable to let nsCSPHostSrc know that it's within
// the frame-ancestors directive.

64
dom/security/nsCSPUtils.cpp
Просмотреть файл

@ -232,7 +232,7 @@ CSP_ContentTypeToDirective(nsContentPolicyType aType)
case nsIContentPolicy::TYPE_INTERNAL_WORKER:
case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER:
case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER:
return nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE;
return nsIContentSecurityPolicy::CHILD_SRC_DIRECTIVE;
case nsIContentPolicy::TYPE_SUBDOCUMENT:
return nsIContentSecurityPolicy::FRAME_SRC_DIRECTIVE;
@ -1190,11 +1190,6 @@ nsCSPDirective::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
outCSP.mSandbox.Value() = mozilla::Move(srcs);
return;
case nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE:
outCSP.mWorker_src.Construct();
outCSP.mWorker_src.Value() = mozilla::Move(srcs);
return;
// REFERRER_DIRECTIVE and REQUIRE_SRI_FOR are handled in nsCSPPolicy::toDomCSPStruct()
default:
@ -1247,8 +1242,7 @@ bool nsCSPDirective::equals(CSPDirective aDirective) const
nsCSPChildSrcDirective::nsCSPChildSrcDirective(CSPDirective aDirective)
: nsCSPDirective(aDirective)
, mRestrictFrames(false)
, mRestrictWorkers(false)
, mHandleFrameSrc(false)
{
}
@ -1256,58 +1250,30 @@ nsCSPChildSrcDirective::~nsCSPChildSrcDirective()
{
}
void nsCSPChildSrcDirective::setHandleFrameSrc()
{
mHandleFrameSrc = true;
}
bool nsCSPChildSrcDirective::restrictsContentType(nsContentPolicyType aContentType) const
{
if (aContentType == nsIContentPolicy::TYPE_SUBDOCUMENT) {
return mRestrictFrames;
return mHandleFrameSrc;
}
if (aContentType == nsIContentPolicy::TYPE_INTERNAL_WORKER ||
aContentType == nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER ||
aContentType == nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER) {
return mRestrictWorkers;
}
return false;
return (aContentType == nsIContentPolicy::TYPE_INTERNAL_WORKER
|| aContentType == nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER
|| aContentType == nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER
);
}
bool nsCSPChildSrcDirective::equals(CSPDirective aDirective) const
{
if (aDirective == nsIContentSecurityPolicy::FRAME_SRC_DIRECTIVE) {
return mRestrictFrames;
return mHandleFrameSrc;
}
if (aDirective == nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE) {
return mRestrictWorkers;
}
return (mDirective == aDirective);
}
/* =============== nsCSPScriptSrcDirective ============= */
nsCSPScriptSrcDirective::nsCSPScriptSrcDirective(CSPDirective aDirective)
: nsCSPDirective(aDirective)
, mRestrictWorkers(false)
{
}
nsCSPScriptSrcDirective::~nsCSPScriptSrcDirective()
{
}
bool nsCSPScriptSrcDirective::restrictsContentType(nsContentPolicyType aContentType) const
{
if (aContentType == nsIContentPolicy::TYPE_INTERNAL_WORKER ||
aContentType == nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER ||
aContentType == nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER) {
return mRestrictWorkers;
}
return mDirective == CSP_ContentTypeToDirective(aContentType);
}
bool nsCSPScriptSrcDirective::equals(CSPDirective aDirective) const
{
if (aDirective == nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE) {
return mRestrictWorkers;
}
return (mDirective == aDirective);
return (aDirective == nsIContentSecurityPolicy::CHILD_SRC_DIRECTIVE);
}
/* =============== nsBlockAllMixedContentDirective ============= */

47
dom/security/nsCSPUtils.h
Просмотреть файл

@ -94,8 +94,7 @@ static const char* CSPStrDirectives[] = {
"child-src", // CHILD_SRC_DIRECTIVE
"block-all-mixed-content", // BLOCK_ALL_MIXED_CONTENT
"require-sri-for", // REQUIRE_SRI_FOR
"sandbox", // SANDBOX_DIRECTIVE
"worker-src" // WORKER_SRC_DIRECTIVE
"sandbox" // SANDBOX_DIRECTIVE
};
inline const char* CSP_CSPDirectiveToString(CSPDirective aDir)
@ -471,7 +470,7 @@ class nsCSPDirective {
bool visitSrcs(nsCSPSrcVisitor* aVisitor) const;
protected:
private:
CSPDirective mDirective;
nsTArray<nsCSPBaseSrc*> mSrcs;
};
@ -479,52 +478,26 @@ class nsCSPDirective {
/* =============== nsCSPChildSrcDirective ============= */
/*
* In CSP 3 child-src is deprecated. For backwards compatibility
* child-src needs to restrict:
* (*) frames, in case frame-src is not expicitly specified
* (*) workers, in case worker-src is not expicitly specified
* In CSP 2, the child-src directive covers both workers and
* subdocuments (i.e., frames and iframes). Workers were removed
* from script-src, but frames can be controlled by either child-src
* or frame-src directives, so child-src needs to know whether it should
* also restrict frames. When both are present the frame-src directive
* takes precedent.
*/
class nsCSPChildSrcDirective : public nsCSPDirective {
public:
explicit nsCSPChildSrcDirective(CSPDirective aDirective);
virtual ~nsCSPChildSrcDirective();
void setRestrictFrames()
{ mRestrictFrames = true; }
void setRestrictWorkers()
{ mRestrictWorkers = true; }
void setHandleFrameSrc();
virtual bool restrictsContentType(nsContentPolicyType aContentType) const;
virtual bool equals(CSPDirective aDirective) const;
private:
bool mRestrictFrames;
bool mRestrictWorkers;
};
/* =============== nsCSPScriptSrcDirective ============= */
/*
* In CSP 3 worker-src restricts workers, for backwards compatibily
* script-src has to restrict workers as the ultimate fallback if
* neither worker-src nor child-src is present in a CSP.
*/
class nsCSPScriptSrcDirective : public nsCSPDirective {
public:
explicit nsCSPScriptSrcDirective(CSPDirective aDirective);
virtual ~nsCSPScriptSrcDirective();
void setRestrictWorkers()
{ mRestrictWorkers = true; }
virtual bool restrictsContentType(nsContentPolicyType aContentType) const;
virtual bool equals(CSPDirective aDirective) const;
private:
bool mRestrictWorkers;
bool mHandleFrameSrc;
};
/* =============== nsBlockAllMixedContentDirective === */

14
dom/security/test/csp/file_frame_src.js
Просмотреть файл

@ -1,14 +0,0 @@
let testframe = document.getElementById("testframe");
testframe.onload = function() {
parent.postMessage({
result: "frame-allowed",
href: document.location.href,
}, "*");
}
testframe.onerror = function() {
parent.postMessage({
result: "frame-blocked",
href: document.location.href,
}, "*");
}
testframe.src = "file_frame_src_inner.html"

10
dom/security/test/csp/file_frame_src_child_governs.html
Просмотреть файл

@ -1,10 +0,0 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="child-src https://example.com">";
</head>
<body>
<iframe id="testframe"></iframe>
<script type="text/javascript" src="file_frame_src.js"></script>
</body>
</html>

10
dom/security/test/csp/file_frame_src_frame_governs.html
Просмотреть файл

@ -1,10 +0,0 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="frame-src https://example.com; child-src 'none'">";
</head>
<body>
<iframe id="testframe"></iframe>
<script type="text/javascript" src="file_frame_src.js"></script>
</body>
</html>

5
dom/security/test/csp/file_frame_src_inner.html
Просмотреть файл

@ -1,5 +0,0 @@
<html>
<body>
dummy iframe
</body>
</html>

1
dom/security/test/csp/file_spawn_service_worker.js
Просмотреть файл

@ -1 +0,0 @@
// dummy file

7
dom/security/test/csp/file_spawn_shared_worker.js
Просмотреть файл

@ -1,7 +0,0 @@
onconnect = function(e) {
var port = e.ports[0];
port.addEventListener("message", function(e) {
port.postMessage("shared worker is executing");
});
port.start();
}

1
dom/security/test/csp/file_spawn_worker.js
Просмотреть файл

@ -1 +0,0 @@
postMessage("worker is executing");

52
dom/security/test/csp/file_worker_src.js
Просмотреть файл

@ -1,52 +0,0 @@
let myWorker = new Worker("file_spawn_worker.js");
myWorker.onmessage = function(event) {
parent.postMessage({
result: "worker-allowed",
href: document.location.href,
}, "*");
}
myWorker.onerror = function(event) {
parent.postMessage({
result: "worker-blocked",
href: document.location.href,
}, "*");
}
// --------------------------------------------
var mySharedWorker = new SharedWorker('file_spawn_shared_worker.js');
mySharedWorker.port.onmessage = function(ev) {
parent.postMessage({
result: "shared-worker-allowed",
href: document.location.href,
}, "*");
}
mySharedWorker.onerror = function(evt) {
evt.preventDefault();
parent.postMessage({
result: "shared-worker-blocked",
href: document.location.href,
}, "*");
}
mySharedWorker.port.start();
mySharedWorker.port.postMessage('foo');
// --------------------------------------------
navigator.serviceWorker.register('file_spawn_service_worker.js')
.then(function(reg) {
// registration worked
reg.unregister().then(function() {
parent.postMessage({
result: "service-worker-allowed",
href: document.location.href,
}, "*");
});
}).catch(function(error) {
// registration failed
parent.postMessage({
result: "service-worker-blocked",
href: document.location.href,
}, "*");
});

9
dom/security/test/csp/file_worker_src_child_governs.html
Просмотреть файл

@ -1,9 +0,0 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="child-src https://example.com; script-src 'nonce-foo'">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

9
dom/security/test/csp/file_worker_src_script_governs.html
Просмотреть файл

@ -1,9 +0,0 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-foo' https://example.com">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

9
dom/security/test/csp/file_worker_src_worker_governs.html
Просмотреть файл

@ -1,9 +0,0 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="worker-src https://example.com; child-src 'none'; script-src 'nonce-foo'">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

15
dom/security/test/csp/mochitest.ini
Просмотреть файл

@ -331,18 +331,3 @@ support-files =
support-files =
file_sandbox_allow_scripts.html
file_sandbox_allow_scripts.html^headers^
[test_worker_src.html]
support-files =
file_worker_src_worker_governs.html
file_worker_src_child_governs.html
file_worker_src_script_governs.html
file_worker_src.js
file_spawn_worker.js
file_spawn_shared_worker.js
file_spawn_service_worker.js
[test_frame_src.html]
support-files =
file_frame_src_frame_governs.html
file_frame_src_child_governs.html
file_frame_src.js
file_frame_src_inner.html

6
dom/security/test/csp/test_child-src_worker.html
Просмотреть файл

@ -83,19 +83,19 @@
id: "script-src-worker",
file: WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
},
'script-src-service_worker': {
id: "script-src-service_worker",
file: SERVICE_WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
},
'script-src-self-shared_worker': {
id: "script-src-self-shared_worker",
file: SHARED_WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
},
};

84
dom/security/test/csp/test_frame_src.html
Просмотреть файл

@ -1,84 +0,0 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1302667 - Test frame-src</title>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We load a page inlcuding a frame a CSP of:
* >> frame-src https://example.com; child-src 'none'
* and make sure that frame-src governs frames correctly. In addition,
* we make sure that child-src is discarded in case frame-src is specified.
*/
const ORIGIN_1 = "https://example.com/tests/dom/security/test/csp/";
const ORIGIN_2 = "https://test1.example.com/tests/dom/security/test/csp/";
let TESTS = [
// frame-src tests
ORIGIN_1 + "file_frame_src_frame_governs.html",
ORIGIN_2 + "file_frame_src_frame_governs.html",
// child-src tests
ORIGIN_1 + "file_frame_src_child_governs.html",
ORIGIN_2 + "file_frame_src_child_governs.html",
];
let testIndex = 0;
function checkFinish() {
if (testIndex >= TESTS.length) {
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
return;
}
runNextTest();
}
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
let href = event.data.href;
let result = event.data.result;
if (href.startsWith("https://example.com")) {
if (result == "frame-allowed") {
ok(true, "allowing frame from https://example.com (" + result + ")");
}
else {
ok(false, "blocking frame from https://example.com (" + result + ")");
}
}
else if (href.startsWith("https://test1.example.com")) {
if (result == "frame-blocked") {
ok(true, "blocking frame from https://test1.example.com (" + result + ")");
}
else {
ok(false, "allowing frame from https://test1.example.com (" + result + ")");
}
}
else {
// sanity check, we should never enter that branch, bust just in case...
ok(false, "unexpected result: " + result);
}
checkFinish();
}
function runNextTest() {
document.getElementById("testframe").src = TESTS[testIndex];
testIndex++;
}
// fire up the tests
runNextTest();
</script>
</body>
</html>

94
dom/security/test/csp/test_worker_src.html
Просмотреть файл

@ -1,94 +0,0 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1302667 - Test worker-src</title>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="worker-testframe"></iframe>
<iframe style="width:100%;" id="child-testframe"></iframe>
<iframe style="width:100%;" id="script-testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We load a page inlcuding a worker, a shared worker as well as a
* service worker with a CSP of:
* >> worker-src https://example.com; child-src 'none'; script-src 'nonce-foo'
* and make sure that worker-src governs these three kinds of workers correctly.
* In addition, we make sure that child-src as well as script-src is discarded
* in case worker-src is specified. Ideally we would use "script-src 'none'" but
* we have to whitelist the actual script that spawns the workers, hence the nonce.
*/
let testRuns = 0;
let messageCounter = 0;
let numberSubTests = 9; // 3 workers * 3 frames = 9
function checkFinish() {
messageCounter = 0;
if (testRuns == 0) {
testRuns++;
runTests("https://test1.example.com/tests/dom/security/test/csp/")
return;
}
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
}
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
let href = event.data.href;
let result = event.data.result;
if (href.startsWith("https://example.com")) {
if (result == "worker-allowed" ||
result == "shared-worker-allowed" ||
result == "service-worker-allowed") {
ok(true, "allowing worker from https://example.com (" + result + ")");
}
else {
ok(false, "blocking worker from https://example.com (" + result + ")");
}
}
else if (href.startsWith("https://test1.example.com")) {
if (result == "worker-blocked" ||
result == "shared-worker-blocked" ||
result == "service-worker-blocked") {
ok(true, "blocking worker from https://test1.example.com (" + result + ")");
}
else {
ok(false, "allowing worker from https://test1.example.com (" + result + ")");
}
}
else {
// sanity check, we should never enter that branch, bust just in case...
ok(false, "unexpected result: " + result);
}
messageCounter++;
if (messageCounter < numberSubTests) {
return;
}
checkFinish();
}
function runTests(aPath) {
document.getElementById("worker-testframe").src = aPath + "file_worker_src_worker_governs.html";
document.getElementById("child-testframe").src = aPath + "file_worker_src_child_governs.html";
document.getElementById("script-testframe").src = aPath + "file_worker_src_script_governs.html";
}
SpecialPowers.pushPrefEnv({"set": [
["dom.serviceWorkers.enabled", true],
["dom.serviceWorkers.testing.enabled", true],
]}, function() {
runTests("https://example.com/tests/dom/security/test/csp/");
});
</script>
</body>
</html>

4
dom/security/test/gtest/TestCSPParser.cpp
Просмотреть файл

@ -219,10 +219,6 @@ TEST(CSPParser, Directives)
"script-src 'nonce-foo' 'strict-dynamic' 'unsafe-inline' https:" },
{ "default-src 'sha256-siVR8' 'strict-dynamic' 'unsafe-inline' https: ",
"default-src 'sha256-siVR8' 'unsafe-inline' https:" },
{ "worker-src https://example.com",
"worker-src https://example.com" },
{ "worker-src http://worker.com; frame-src http://frame.com; child-src http://child.com",
"worker-src http://worker.com; frame-src http://frame.com; child-src http://child.com" },
};
uint32_t policyCount = sizeof(policies) / sizeof(PolicyTest);

1
dom/webidl/CSPDictionaries.webidl
Просмотреть файл

@ -30,7 +30,6 @@ dictionary CSP {
sequence<DOMString> block-all-mixed-content;
sequence<DOMString> require-sri-for;
sequence<DOMString> sandbox;
sequence<DOMString> worker-src;
};
dictionary CSPPolicies {

8
testing/web-platform/meta/content-security-policy/worker-src/dedicated-fallback.sub.html.ini Normal file
Просмотреть файл

@ -0,0 +1,8 @@
[dedicated-fallback.sub.html]
type: testharness
[Same-origin dedicated worker allowed by host-source expression.]
expected: FAIL
[blob: dedicated worker allowed by 'blob:'.]
expected: FAIL

5
testing/web-platform/meta/content-security-policy/worker-src/service-fallback.https.sub.html.ini Normal file
Просмотреть файл

@ -0,0 +1,5 @@
[service-fallback.https.sub.html]
type: testharness
[Same-origin service worker allowed by host-source expression.]
expected: FAIL

8
testing/web-platform/meta/content-security-policy/worker-src/shared-fallback.sub.html.ini Normal file
Просмотреть файл

@ -0,0 +1,8 @@
[shared-fallback.sub.html]
type: testharness
[Same-origin dedicated worker allowed by 'self'.]
expected: FAIL
[blob: dedicated worker allowed by 'blob:'.]
expected: FAIL