wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-06 07:17:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add support for CSP v3 "worker-src" directive

Browse source
This commit is contained in:
wolfbeast 2018-03-03 11:21:43 +01:00 • committed by Roy Tam
commit 0665a343a5
23 changed files with 469 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dom/security/test/csp/file_frame_src.js Normal file
View file

@ -0,0 +1,14 @@
let testframe = document.getElementById("testframe");
testframe.onload = function() {
parent.postMessage({
result: "frame-allowed",
href: document.location.href,
}, "*");
}
testframe.onerror = function() {
parent.postMessage({
result: "frame-blocked",
href: document.location.href,
}, "*");
}
testframe.src = "file_frame_src_inner.html"

10
dom/security/test/csp/file_frame_src_child_governs.html Normal file
View file

@ -0,0 +1,10 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="child-src https://example.com">";
</head>
<body>
<iframe id="testframe"></iframe>
<script type="text/javascript" src="file_frame_src.js"></script>
</body>
</html>

10
dom/security/test/csp/file_frame_src_frame_governs.html Normal file
View file

@ -0,0 +1,10 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="frame-src https://example.com; child-src 'none'">";
</head>
<body>
<iframe id="testframe"></iframe>
<script type="text/javascript" src="file_frame_src.js"></script>
</body>
</html>

5
dom/security/test/csp/file_frame_src_inner.html Normal file
View file

@ -0,0 +1,5 @@
<html>
<body>
dummy iframe
</body>
</html>

1
dom/security/test/csp/file_spawn_service_worker.js Normal file
View file

@ -0,0 +1 @@
// dummy file

7
dom/security/test/csp/file_spawn_shared_worker.js Normal file
View file

@ -0,0 +1,7 @@
onconnect = function(e) {
var port = e.ports[0];
port.addEventListener("message", function(e) {
port.postMessage("shared worker is executing");
});
port.start();
}

1
dom/security/test/csp/file_spawn_worker.js Normal file
View file

@ -0,0 +1 @@
postMessage("worker is executing");

52
dom/security/test/csp/file_worker_src.js Normal file
View file

@ -0,0 +1,52 @@
let myWorker = new Worker("file_spawn_worker.js");
myWorker.onmessage = function(event) {
parent.postMessage({
result: "worker-allowed",
href: document.location.href,
}, "*");
}
myWorker.onerror = function(event) {
parent.postMessage({
result: "worker-blocked",
href: document.location.href,
}, "*");
}
// --------------------------------------------
var mySharedWorker = new SharedWorker('file_spawn_shared_worker.js');
mySharedWorker.port.onmessage = function(ev) {
parent.postMessage({
result: "shared-worker-allowed",
href: document.location.href,
}, "*");
}
mySharedWorker.onerror = function(evt) {
evt.preventDefault();
parent.postMessage({
result: "shared-worker-blocked",
href: document.location.href,
}, "*");
}
mySharedWorker.port.start();
mySharedWorker.port.postMessage('foo');
// --------------------------------------------
navigator.serviceWorker.register('file_spawn_service_worker.js')
.then(function(reg) {
// registration worked
reg.unregister().then(function() {
parent.postMessage({
result: "service-worker-allowed",
href: document.location.href,
}, "*");
});
}).catch(function(error) {
// registration failed
parent.postMessage({
result: "service-worker-blocked",
href: document.location.href,
}, "*");
});

9
dom/security/test/csp/file_worker_src_child_governs.html Normal file
View file

@ -0,0 +1,9 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="child-src https://example.com; script-src 'nonce-foo'">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

9
dom/security/test/csp/file_worker_src_script_governs.html Normal file
View file

@ -0,0 +1,9 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-foo' https://example.com">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

9
dom/security/test/csp/file_worker_src_worker_governs.html Normal file
View file

@ -0,0 +1,9 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="worker-src https://example.com; child-src 'none'; script-src 'nonce-foo'">";
</head>
<body>
<script type="text/javascript" src="file_worker_src.js" nonce="foo"></script>
</body>
</html>

15
dom/security/test/csp/mochitest.ini
View file

@ -316,3 +316,18 @@ support-files =
[test_punycode_host_src.html]
[test_websocket_self.html]
skip-if = toolkit == 'android'
[test_worker_src.html]
support-files =
file_worker_src_worker_governs.html
file_worker_src_child_governs.html
file_worker_src_script_governs.html
file_worker_src.js
file_spawn_worker.js
file_spawn_shared_worker.js
file_spawn_service_worker.js
[test_frame_src.html]
support-files =
file_frame_src_frame_governs.html
file_frame_src_child_governs.html
file_frame_src.js
file_frame_src_inner.html

6
dom/security/test/csp/test_child-src_worker.html
View file

@ -83,19 +83,19 @@
id: "script-src-worker",
file: WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
},
'script-src-service_worker': {
id: "script-src-service_worker",
file: SERVICE_WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
},
'script-src-self-shared_worker': {
id: "script-src-self-shared_worker",
file: SHARED_WORKER_TEST_FILE,
result : "blocked",
policy : "default-src 'none'; script-src 'self' 'unsafe-inline'"
policy : "default-src 'none'; script-src https://www.example.org 'unsafe-inline'"
},
};

84
dom/security/test/csp/test_frame_src.html Normal file
View file

@ -0,0 +1,84 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1302667 - Test frame-src</title>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We load a page inlcuding a frame a CSP of:
* >> frame-src https://example.com; child-src 'none'
* and make sure that frame-src governs frames correctly. In addition,
* we make sure that child-src is discarded in case frame-src is specified.
*/
const ORIGIN_1 = "https://example.com/tests/dom/security/test/csp/";
const ORIGIN_2 = "https://test1.example.com/tests/dom/security/test/csp/";
let TESTS = [
// frame-src tests
ORIGIN_1 + "file_frame_src_frame_governs.html",
ORIGIN_2 + "file_frame_src_frame_governs.html",
// child-src tests
ORIGIN_1 + "file_frame_src_child_governs.html",
ORIGIN_2 + "file_frame_src_child_governs.html",
];
let testIndex = 0;
function checkFinish() {
if (testIndex >= TESTS.length) {
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
return;
}
runNextTest();
}
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
let href = event.data.href;
let result = event.data.result;
if (href.startsWith("https://example.com")) {
if (result == "frame-allowed") {
ok(true, "allowing frame from https://example.com (" + result + ")");
}
else {
ok(false, "blocking frame from https://example.com (" + result + ")");
}
}
else if (href.startsWith("https://test1.example.com")) {
if (result == "frame-blocked") {
ok(true, "blocking frame from https://test1.example.com (" + result + ")");
}
else {
ok(false, "allowing frame from https://test1.example.com (" + result + ")");
}
}
else {
// sanity check, we should never enter that branch, bust just in case...
ok(false, "unexpected result: " + result);
}
checkFinish();
}
function runNextTest() {
document.getElementById("testframe").src = TESTS[testIndex];
testIndex++;
}
// fire up the tests
runNextTest();
</script>
</body>
</html>

94
dom/security/test/csp/test_worker_src.html Normal file
View file

@ -0,0 +1,94 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1302667 - Test worker-src</title>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="worker-testframe"></iframe>
<iframe style="width:100%;" id="child-testframe"></iframe>
<iframe style="width:100%;" id="script-testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We load a page inlcuding a worker, a shared worker as well as a
* service worker with a CSP of:
* >> worker-src https://example.com; child-src 'none'; script-src 'nonce-foo'
* and make sure that worker-src governs these three kinds of workers correctly.
* In addition, we make sure that child-src as well as script-src is discarded
* in case worker-src is specified. Ideally we would use "script-src 'none'" but
* we have to whitelist the actual script that spawns the workers, hence the nonce.
*/
let testRuns = 0;
let messageCounter = 0;
let numberSubTests = 9; // 3 workers * 3 frames = 9
function checkFinish() {
messageCounter = 0;
if (testRuns == 0) {
testRuns++;
runTests("https://test1.example.com/tests/dom/security/test/csp/")
return;
}
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
}
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
let href = event.data.href;
let result = event.data.result;
if (href.startsWith("https://example.com")) {
if (result == "worker-allowed" ||
result == "shared-worker-allowed" ||
result == "service-worker-allowed") {
ok(true, "allowing worker from https://example.com (" + result + ")");
}
else {
ok(false, "blocking worker from https://example.com (" + result + ")");
}
}
else if (href.startsWith("https://test1.example.com")) {
if (result == "worker-blocked" ||
result == "shared-worker-blocked" ||
result == "service-worker-blocked") {
ok(true, "blocking worker from https://test1.example.com (" + result + ")");
}
else {
ok(false, "allowing worker from https://test1.example.com (" + result + ")");
}
}
else {
// sanity check, we should never enter that branch, bust just in case...
ok(false, "unexpected result: " + result);
}
messageCounter++;
if (messageCounter < numberSubTests) {
return;
}
checkFinish();
}
function runTests(aPath) {
document.getElementById("worker-testframe").src = aPath + "file_worker_src_worker_governs.html";
document.getElementById("child-testframe").src = aPath + "file_worker_src_child_governs.html";
document.getElementById("script-testframe").src = aPath + "file_worker_src_script_governs.html";
}
SpecialPowers.pushPrefEnv({"set": [
["dom.serviceWorkers.enabled", true],
["dom.serviceWorkers.testing.enabled", true],
]}, function() {
runTests("https://example.com/tests/dom/security/test/csp/");
});
</script>
</body>
</html>

4
dom/security/test/gtest/TestCSPParser.cpp
View file

@ -240,6 +240,10 @@ TEST(CSPParser, Directives)
"script-src 'nonce-foo' 'strict-dynamic' 'unsafe-inline' https:" },
{ "default-src 'sha256-siVR8' 'strict-dynamic' 'unsafe-inline' https: ",
"default-src 'sha256-siVR8' 'unsafe-inline' https:" },
{ "worker-src https://example.com",
"worker-src https://example.com" },
{ "worker-src http://worker.com; frame-src http://frame.com; child-src http://child.com",
"worker-src http://worker.com; frame-src http://frame.com; child-src http://child.com" },
};
uint32_t policyCount = sizeof(policies) / sizeof(PolicyTest);