Diff
Modified: trunk/LayoutTests/ChangeLog (232932 => 232933)
--- trunk/LayoutTests/ChangeLog 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/LayoutTests/ChangeLog 2018-06-18 17:30:02 UTC (rev 232933)
@@ -1,3 +1,17 @@
+2018-06-18 Youenn Fablet <you...@apple.com>
+
+ Validate Cross-Origin-Resource-Policy for resources cached in the MemoryCache
+ https://bugs.webkit.org/show_bug.cgi?id=186639
+ <rdar://problem/41106984>
+
+ Reviewed by Geoffrey Garen.
+
+ * http/wpt/cross-origin-resource-policy/image-in-iframe-loads-expected.txt: Added.
+ * http/wpt/cross-origin-resource-policy/image-in-iframe-loads.html: Added.
+ * http/wpt/cross-origin-resource-policy/resources/iframeImage.html: Added.
+ * http/wpt/cross-origin-resource-policy/resources/image.py:
+ (main):
+
2018-06-18 Zan Dobersek <zdober...@igalia.com>
Unreviewed WPE gardening. Manage the current set of CSS3 Filters and
Added: trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads-expected.txt (0 => 232933)
--- trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads-expected.txt (rev 0)
+++ trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads-expected.txt 2018-06-18 17:30:02 UTC (rev 232933)
@@ -0,0 +1,4 @@
+
+
+PASS Ensure CORP checks in case image is cached
+
Added: trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads.html (0 => 232933)
--- trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads.html (rev 0)
+++ trunk/LayoutTests/http/wpt/cross-origin-resource-policy/image-in-iframe-loads.html 2018-06-18 17:30:02 UTC (rev 232933)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script src=""
+ <script src=""
+ <script src=""
+</head>
+<body>
+ <script>
+const host = get_host_info();
+const remoteBaseURL = host.HTTP_REMOTE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
+const localBaseURL = host.HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
+
+function with_iframe(url) {
+ return new Promise(function(resolve) {
+ var frame = document.createElement('iframe');
+ frame.src = ""
+ frame._onload_ = function() { resolve(frame); };
+ document.body.appendChild(frame);
+ });
+}
+
+promise_test(async() => {
+ let message = new Promise((resolve) => {
+ window.addEventListener("message", (event) => { resolve(event.data) });
+ });
+ await with_iframe(localBaseURL + "/resources/iframeImage.html");
+ assert_equals(await message, "ok", "loading same origin image should succeed");
+
+ message = new Promise((resolve) => {
+ window.addEventListener("message", (event) => { resolve(event.data) });
+ });
+ await with_iframe(remoteBaseURL + "/resources/iframeImage.html");
+ assert_equals(await message, "ko", "loading not same origin image should succeed");
+}, "Ensure CORP checks in case image is cached");
+ </script>
+</body>
+</html>
Added: trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/iframeImage.html (0 => 232933)
--- trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/iframeImage.html (rev 0)
+++ trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/iframeImage.html 2018-06-18 17:30:02 UTC (rev 232933)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <div id="testDiv"></div>
+ <h3>The iframe making an image load.</h3>
+ <script src=""
+ <script>
+const host = get_host_info();
+const baseURL = host.HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
+const ok = true;
+const ko = false;
+
+const img = new Image();
+img.src = "" + "image.py?corp=same-origin&cached";
+img._onload_ = () => { parent.postMessage("ok", "*") };
+img._onerror_ = () => { parent.postMessage("ko", "*") };
+testDiv.appendChild(img);
+ </script>
+</body>
+</html>
Modified: trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/image.py (232932 => 232933)
--- trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/image.py 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/LayoutTests/http/wpt/cross-origin-resource-policy/resources/image.py 2018-06-18 17:30:02 UTC (rev 232933)
@@ -8,6 +8,9 @@
response.add_required_headers = False
response.writer.write_status(200)
+ if 'cached' in request.GET:
+ response.writer.write_header("Cache-Control", "max-age=600000")
+
if 'corp' in request.GET:
response.writer.write_header("cross-origin-resource-policy", request.GET['corp'])
if 'acao' in request.GET:
Modified: trunk/Source/WebCore/ChangeLog (232932 => 232933)
--- trunk/Source/WebCore/ChangeLog 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebCore/ChangeLog 2018-06-18 17:30:02 UTC (rev 232933)
@@ -1,3 +1,27 @@
+2018-06-18 Youenn Fablet <you...@apple.com>
+
+ Validate Cross-Origin-Resource-Policy for resources cached in the MemoryCache
+ https://bugs.webkit.org/show_bug.cgi?id=186639
+ <rdar://problem/41106984>
+
+ Reviewed by Geoffrey Garen.
+
+ Add a method to check CORP.
+ Make use of it to validate any memory cached resource.
+ Whitelist CORP header so that it is not filtered out by Network Process.
+
+ Test: http/wpt/cross-origin-resource-policy/image-in-iframe-loads.html
+
+ * loader/CrossOriginAccessControl.cpp:
+ (WebCore::shouldCrossOriginResourcePolicyCancelLoad):
+ (WebCore::validateCrossOriginResourcePolicy):
+ * loader/CrossOriginAccessControl.h:
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::requestResource):
+ * platform/network/ResourceResponseBase.cpp:
+ (WebCore::isSafeRedirectionResponseHeader):
+ (WebCore::isSafeCrossOriginResponseHeader):
+
2018-06-18 Carlos Alberto Lopez Perez <clo...@igalia.com>
[WTF] Remove workarounds needed to support libstdc++-4
Modified: trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp (232932 => 232933)
--- trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp 2018-06-18 17:30:02 UTC (rev 232933)
@@ -208,4 +208,34 @@
return true;
}
+static inline bool shouldCrossOriginResourcePolicyCancelLoad(const SecurityOrigin& origin, const ResourceResponse& response)
+{
+ if (origin.canRequest(response.url()))
+ return false;
+
+ auto policy = parseCrossOriginResourcePolicyHeader(response.httpHeaderField(HTTPHeaderName::CrossOriginResourcePolicy));
+ switch (policy) {
+ case CrossOriginResourcePolicy::None:
+ case CrossOriginResourcePolicy::Invalid:
+ return false;
+ case CrossOriginResourcePolicy::SameOrigin:
+ return true;
+ case CrossOriginResourcePolicy::SameSite: {
+#if ENABLE(PUBLIC_SUFFIX_LIST)
+ return origin.isUnique() || !registrableDomainsAreEqual(response.url(), ResourceRequest::partitionName(origin.host()));
+#else
+ return true;
+#endif
+ }}
+
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
+std::optional<ResourceError> validateCrossOriginResourcePolicy(const SecurityOrigin& origin, const URL& requestURL, const ResourceResponse& response)
+{
+ if (shouldCrossOriginResourcePolicyCancelLoad(origin, response))
+ return ResourceError { errorDomainWebKitInternal, 0, requestURL, makeString("Cancelled load to ", response.url().stringCenterEllipsizedToLength(), " because it violates the resource's Cross-Origin-Resource-Policy response header."), ResourceError::Type::AccessControl };
+ return std::nullopt;
+}
+
} // namespace WebCore
Modified: trunk/Source/WebCore/loader/CrossOriginAccessControl.h (232932 => 232933)
--- trunk/Source/WebCore/loader/CrossOriginAccessControl.h 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebCore/loader/CrossOriginAccessControl.h 2018-06-18 17:30:02 UTC (rev 232933)
@@ -34,6 +34,7 @@
namespace WebCore {
class HTTPHeaderMap;
+class ResourceError;
class ResourceRequest;
class ResourceResponse;
class SecurityOrigin;
@@ -56,4 +57,6 @@
WEBCORE_EXPORT bool passesAccessControlCheck(const ResourceResponse&, StoredCredentialsPolicy, SecurityOrigin&, String& errorDescription);
WEBCORE_EXPORT bool validatePreflightResponse(const ResourceRequest&, const ResourceResponse&, StoredCredentialsPolicy, SecurityOrigin&, String& errorDescription);
+WEBCORE_EXPORT std::optional<ResourceError> validateCrossOriginResourcePolicy(const SecurityOrigin&, const URL&, const ResourceResponse&);
+
} // namespace WebCore
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (232932 => 232933)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2018-06-18 17:30:02 UTC (rev 232933)
@@ -893,6 +893,10 @@
break;
case Use:
ASSERT(resource);
+ if (request.options().mode == FetchOptions::Mode::NoCors) {
+ if (auto error = validateCrossOriginResourcePolicy(*request.origin(), request.resourceRequest().url(), resource->response()))
+ return makeUnexpected(WTFMove(*error));
+ }
if (shouldUpdateCachedResourceWithCurrentRequest(*resource, request)) {
resource = updateCachedResourceWithCurrentRequest(*resource, WTFMove(request));
if (resource->status() != CachedResource::Status::Cached)
Modified: trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp (232932 => 232933)
--- trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2018-06-18 17:30:02 UTC (rev 232933)
@@ -333,6 +333,7 @@
|| name == HTTPHeaderName::AccessControlAllowOrigin
|| name == HTTPHeaderName::AccessControlExposeHeaders
|| name == HTTPHeaderName::AccessControlMaxAge
+ || name == HTTPHeaderName::CrossOriginResourcePolicy
|| name == HTTPHeaderName::TimingAllowOrigin;
}
@@ -358,6 +359,7 @@
|| name == HTTPHeaderName::ContentSecurityPolicy
|| name == HTTPHeaderName::ContentSecurityPolicyReportOnly
|| name == HTTPHeaderName::ContentType
+ || name == HTTPHeaderName::CrossOriginResourcePolicy
|| name == HTTPHeaderName::Date
|| name == HTTPHeaderName::ETag
|| name == HTTPHeaderName::Expires
Modified: trunk/Source/WebKit/ChangeLog (232932 => 232933)
--- trunk/Source/WebKit/ChangeLog 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebKit/ChangeLog 2018-06-18 17:30:02 UTC (rev 232933)
@@ -1,3 +1,17 @@
+2018-06-18 Youenn Fablet <you...@apple.com>
+
+ Validate Cross-Origin-Resource-Policy for resources cached in the MemoryCache
+ https://bugs.webkit.org/show_bug.cgi?id=186639
+ <rdar://problem/41106984>
+
+ Reviewed by Geoffrey Garen.
+
+ Make use of WebCore method to check CORP.
+
+ * NetworkProcess/NetworkLoadChecker.cpp:
+ (WebKit::NetworkLoadChecker::validateResponse):
+ * NetworkProcess/NetworkLoadChecker.h:
+
2018-06-18 Karl Leplat <karl.leplat_...@softathome.com>
[Threaded paintingEngine] Fix rendering glitches
Modified: trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp (232932 => 232933)
--- trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp 2018-06-18 17:30:02 UTC (rev 232933)
@@ -131,29 +131,6 @@
checkRequest(WTFMove(request), WTFMove(handler));
}
-bool NetworkLoadChecker::shouldCrossOriginResourcePolicyPolicyCancelLoad(const ResourceResponse& response)
-{
- if (m_origin->canRequest(response.url()))
- return false;
-
- auto policy = parseCrossOriginResourcePolicyHeader(response.httpHeaderField(HTTPHeaderName::CrossOriginResourcePolicy));
- switch (policy) {
- case CrossOriginResourcePolicy::None:
- case CrossOriginResourcePolicy::Invalid:
- return false;
- case CrossOriginResourcePolicy::SameOrigin:
- return true;
- case CrossOriginResourcePolicy::SameSite: {
-#if ENABLE(PUBLIC_SUFFIX_LIST)
- return m_origin->isUnique() || !registrableDomainsAreEqual(response.url(), ResourceRequest::partitionName(m_origin->host()));
-#else
- return true;
-#endif
- }}
-
- RELEASE_ASSERT_NOT_REACHED();
-}
-
ResourceError NetworkLoadChecker::validateResponse(ResourceResponse& response)
{
if (m_redirectCount)
@@ -170,8 +147,9 @@
}
if (m_options.mode == FetchOptions::Mode::NoCors) {
- if (shouldCrossOriginResourcePolicyPolicyCancelLoad(response))
- return ResourceError { errorDomainWebKitInternal, 0, m_url, makeString("Cancelled load to ", response.url().stringCenterEllipsizedToLength(), " because it violates the resource's Cross-Origin-Resource-Policy response header."), ResourceError::Type::AccessControl };
+ if (auto error = validateCrossOriginResourcePolicy(*m_origin, m_url, response))
+ return WTFMove(*error);
+
response.setTainting(ResourceResponse::Tainting::Opaque);
return { };
}
Modified: trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.h (232932 => 232933)
--- trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.h 2018-06-18 15:55:43 UTC (rev 232932)
+++ trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.h 2018-06-18 17:30:02 UTC (rev 232933)
@@ -108,8 +108,6 @@
uint64_t m_webFrameID;
ResourceLoadIdentifier m_loadIdentifier;
- bool shouldCrossOriginResourcePolicyPolicyCancelLoad(const WebCore::ResourceResponse&);
-
WebCore::FetchOptions m_options;
WebCore::StoredCredentialsPolicy m_storedCredentialsPolicy;
PAL::SessionID m_sessionID;
