ChangeLog

2013-02-13  Mike West  <mkwst@chromium.org>

        CSP 1.1: Experiment with 'reflected-xss' directive.

        https://bugs.webkit.org/show_bug.cgi?id=104479

        Reviewed by NOBODY (OOPS!).

        Content Security Policy 1.1 defines a 'reflected-xss' directive that

        works in much the same way as WebKit's current 'X-XSS-Protection'

        header[1]. This patch implements the new directive by parsing it

        inside ContentSecurityPolicy, and exposing that state to XSSAuditor.

        XSSAuditor now grabs the CSP directive's state, and mixes it with the

        X-XSS-Protection header's state to determine how the page should be

        handled. Moreover, both headers' states are now expressed in terms of

        ContentSecurityPolicy::ReflectedXSSDisposition.

        [1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#reflected-xss--experimental

        Tests: http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html

               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html

        * html/parser/XSSAuditor.cpp:

        (WebCore::combineXSSProtectionHeaderAndCSP):

            Given both headers' states, return the state which the XSSAuditor

            should use when parsing a page. Blocking overrides filtering, which

            overrides disabling.

        (WebCore):

        (WebCore::XSSAuditor::init):

            Process the 'X-XSS-Protection' header before grabbing the CSP

            header's state. Both are passed into the new

            combineXSSProtectionHeaderAndCSP method to generate the final

            state that ought to be used.

        (WebCore::XSSAuditor::XSSAuditor):

        (WebCore::XSSAuditor::filterToken):

        * html/parser/XSSAuditor.h:

            Switch to ContentSecurityPolicy::ReflectedXSSDisposition internally

            in XSSAuditor.

        * page/ContentSecurityPolicy.cpp:

        (WebCore::CSPDirectiveList::reflectedXSSDisposition):

            Enum defining the possible state of the 'reflected-xss' CSP directive.

        (CSPDirectiveList):

        (WebCore::CSPDirectiveList::CSPDirectiveList):

        (WebCore::CSPDirectiveList::parseReflectedXSS):

            Given a 'reflected-xss' directive's value, set the

            ReflectedXSSDisposition into a new property on the CSPDirectiveList.

        (WebCore):

        (WebCore::CSPDirectiveList::addDirective):

            Accept 'reflected-xss' as a valid directive if we're in

            experimental mode.

        (WebCore::ContentSecurityPolicy::reflectedXSSDisposition):

            Expose the directive's state via the public API.

        (WebCore::ContentSecurityPolicy::reportInvalidReflectedXSS):

            Generate console errors when invalid reflected-xss directive values

            are encounted during parsing.

        * page/ContentSecurityPolicy.h:

        * platform/network/HTTPParsers.cpp:

        (WebCore::parseXSSProtectionHeader):

        * platform/network/HTTPParsers.h:

        (WebCore):

            Start using ContentSecurityPolicy::ReflectedXSSDisposition rather

            than the XSSProtectionDisposition enum.

2013-02-12  Kentaro Hara  <haraken@chromium.org>

        [V8] Generate wrapper methods for custom getters/setters

Source/WebCore/html/parser/XSSAuditor.cpp

#include "XSSAuditor.h"

#include "Console.h"

31#include "ContentSecurityPolicy.h"

#include "DOMWindow.h"

#include "DecodeEscapeSequences.h"

#include "Document.h"

@@static String fullyDecodeString(const String& string, const TextEncoding& encodi

    return workingString;

}

static ContentSecurityPolicy::ReflectedXSSDisposition combineXSSProtectionHeaderAndCSP(ContentSecurityPolicy::ReflectedXSSDisposition xssProtection, ContentSecurityPolicy::ReflectedXSSDisposition reflectedXSS)

{

    ContentSecurityPolicy::ReflectedXSSDisposition result = std::max(xssProtection, reflectedXSS);

    if (result == ContentSecurityPolicy::ReflectedXSSInvalid || result == ContentSecurityPolicy::FilterReflectedXSS || result == ContentSecurityPolicy::ReflectedXSSUnset)

        return ContentSecurityPolicy::FilterReflectedXSS;

    return result;

}

176187XSSAuditor::XSSAuditor()

177188 : m_isEnabled(false)

178 , m_xssProtection(XSS~~ProtectionEnabled~~)

189 , m_xssProtection(ContentSecurityPolicy::FilterReflectedXSS)

    , m_state(Uninitialized)

    , m_scriptTagNestingLevel(0)

    , m_encoding(UTF8Encoding())

@@void XSSAuditor::init(Document* document)

        String errorDetails;

        unsigned errorPosition = 0;

        String reportURL;

239 m_xssProtection ~~= parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, r~~eportURL);

250 KURL xssProtectionReportURL;

240251

        if ((m_xssProtection == XSSProtectionEnabled || m_xssProtection == XSSProtectionBlockEnabled) && !reportURL.isEmpty()) {

            m_reportURL = document->completeURL(reportURL);

            if (MixedContentChecker::isMixedContent(document->securityOrigin(), m_reportURL)) {

        // Process the X-XSS-Protection header, then mix in the CSP header's value.

        ContentSecurityPolicy::ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, reportURL);

        if ((xssProtectionHeader == ContentSecurityPolicy::FilterReflectedXSS || xssProtectionHeader == ContentSecurityPolicy::BlockReflectedXSS) && !reportURL.isEmpty()) {

            xssProtectionReportURL = document->completeURL(reportURL);

            if (MixedContentChecker::isMixedContent(document->securityOrigin(), xssProtectionReportURL)) {

244257 errorDetails = "insecure reporting URL for secure page";

245 m_xssProtection = XSS~~Protection~~Invalid;

246 m_reportURL = KURL();

258 xssProtectionHeader = ContentSecurityPolicy::ReflectedXSSInvalid;

259 xssProtectionReportURL = KURL();

247260 }

248261 }

249

250 if (m_xssProtection == XSSProtectionInvalid) {

262 if (xssProtectionHeader == ContentSecurityPolicy::ReflectedXSSInvalid)

251263 document->addConsoleMessage(JSMessageSource, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue + ": " + errorDetails + " at character position " + String::format("%u", errorPosition) + ". The default protections will be applied.");

252 m_xssProtection = XSSProtectionEnabled;

253 }

        m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader, document->contentSecurityPolicy()->reflectedXSSDisposition());

        m_reportURL = xssProtectionReportURL; // FIXME: Combine the two report URLs in some reasonable way.

        FormData* httpBody = documentLoader->originalRequest().httpBody();

        if (httpBody && !httpBody->isEmpty()) {

@@void XSSAuditor::init(Document* document)

PassOwnPtr<XSSInfo> XSSAuditor::filterToken(const FilterTokenRequest& request)

{

    ASSERT(m_state == Initialized);

283 if (!m_isEnabled || m_xssProtection == XSS~~ProtectionDisabled~~)

296 if (!m_isEnabled || m_xssProtection == ContentSecurityPolicy::AllowReflectedXSS)

        return nullptr;

    bool didBlockScript = false;

@@PassOwnPtr<XSSInfo> XSSAuditor::filterToken(const FilterTokenRequest& request)

    }

    if (didBlockScript) {

297 bool didBlockEntirePage = (m_xssProtection == ~~XSSPr~~otect~~ion~~Block~~Enab~~led);

310 bool didBlockEntirePage = (m_xssProtection == ContentSecurityPolicy::BlockReflectedXSS);

        OwnPtr<XSSInfo> xssInfo = XSSInfo::create(m_reportURL, m_originalURL, m_originalHTTPBody, didBlockEntirePage);

        if (!m_reportURL.isEmpty()) {

            m_reportURL = KURL();

Source/WebCore/html/parser/XSSAuditor.h

@@private:

    KURL m_documentURL;

    bool m_isEnabled;

104 XSS~~Protection~~Disposition m_xssProtection;

104 ContentSecurityPolicy::ReflectedXSSDisposition m_xssProtection;

    String m_originalURL;

    String m_originalHTTPBody;

Source/WebCore/page/ContentSecurityPolicy.cpp

@@static const char styleSrc[] = "style-src";

static const char formAction[] = "form-action";

static const char pluginTypes[] = "plugin-types";

static const char scriptNonce[] = "script-nonce";

123static const char reflectedXSS[] = "reflected-xss";

#endif

bool isDirectiveName(const String& name)

@@bool isDirectiveName(const String& name)

        || equalIgnoringCase(name, formAction)

        || equalIgnoringCase(name, pluginTypes)

        || equalIgnoringCase(name, scriptNonce)

143 || equalIgnoringCase(name, reflectedXSS)

#endif

    );

}

@@public:

    void gatherReportURIs(DOMStringList&) const;

    const String& evalDisabledErrorMessage() { return m_evalDisabledErrorMessage; }

844 ContentSecurityPolicy::ReflectedXSSDisposition reflectedXSSDisposition() const { return m_reflectedXSSDisposition; }

private:

    CSPDirectiveList(ContentSecurityPolicy*, ContentSecurityPolicy::HeaderType);

@@private:

    void parseReportURI(const String& name, const String& value);

    void parseScriptNonce(const String& name, const String& value);

    void parsePluginTypes(const String& name, const String& value);

855 void parseReflectedXSS(const String& name, const String& value);

    void addDirective(const String& name, const String& value);

    void applySandboxPolicy(const String& name, const String& sandboxPolicy);

@@private:

    bool m_experimental;

    bool m_reportOnly;

    bool m_haveSandboxPolicy;

890 ContentSecurityPolicy::ReflectedXSSDisposition m_reflectedXSSDisposition;

    OwnPtr<MediaListDirective> m_pluginTypes;

    OwnPtr<NonceDirective> m_scriptNonce;

@@CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurit

    , m_experimental(false)

    , m_reportOnly(false)

    , m_haveSandboxPolicy(false)

916 , m_reflectedXSSDisposition(ContentSecurityPolicy::ReflectedXSSUnset)

{

    m_reportOnly = (type == ContentSecurityPolicy::ReportStableDirectives || type == ContentSecurityPolicy::ReportAllDirectives);

    m_experimental = (type == ContentSecurityPolicy::ReportAllDirectives || type == ContentSecurityPolicy::EnforceAllDirectives);

@@void CSPDirectiveList::applySandboxPolicy(const String& name, const String& sand

        m_policy->reportInvalidSandboxFlags(invalidTokens);

}

void CSPDirectiveList::parseReflectedXSS(const String& name, const String& value)

{

    if (m_reflectedXSSDisposition != ContentSecurityPolicy::ReflectedXSSUnset) {

        m_policy->reportDuplicateDirective(name);

        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;

        return;

    }

    if (value.isEmpty()) {

        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;

        m_policy->reportInvalidReflectedXSS(value);

        return;

    }

    const UChar* position = value.characters();

    const UChar* end = position + value.length();

    skipWhile<isASCIISpace>(position, end);

    const UChar* begin = position;

    skipWhile<isNotASCIISpace>(position, end);

    // value1

    //       ^

    if (equalIgnoringCase("allow", begin, position - begin))

        m_reflectedXSSDisposition = ContentSecurityPolicy::AllowReflectedXSS;

    else if (equalIgnoringCase("filter", begin, position - begin))

        m_reflectedXSSDisposition = ContentSecurityPolicy::FilterReflectedXSS;

    else if (equalIgnoringCase("block", begin, position - begin))

        m_reflectedXSSDisposition = ContentSecurityPolicy::BlockReflectedXSS;

    else {

        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;

        m_policy->reportInvalidReflectedXSS(value);

        return;

    }

    skipWhile<isASCIISpace>(position, end);

    if (position == end && m_reflectedXSSDisposition != ContentSecurityPolicy::ReflectedXSSUnset)

        return;

    // value1 value2

    //        ^

    m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;

    m_policy->reportInvalidReflectedXSS(value);

}

void CSPDirectiveList::addDirective(const String& name, const String& value)

{

    ASSERT(!name.isEmpty());

@@void CSPDirectiveList::addDirective(const String& name, const String& value)

            setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);

        else if (equalIgnoringCase(name, scriptNonce))

            setCSPDirective<NonceDirective>(name, value, m_scriptNonce);

1403 else if (equalIgnoringCase(name, reflectedXSS))

1404 parseReflectedXSS(name, value);

    }

#endif

    else

@@bool ContentSecurityPolicy::isActive() const

    return !m_policies.isEmpty();

}

ContentSecurityPolicy::ReflectedXSSDisposition ContentSecurityPolicy::reflectedXSSDisposition() const

{

    ReflectedXSSDisposition disposition = ReflectedXSSUnset;

    for (size_t i = 0; i < m_policies.size(); ++i) {

        if (m_policies[i]->reflectedXSSDisposition() > disposition)

            disposition = m_policies[i]->reflectedXSSDisposition();

    }

    return disposition;

}

void ContentSecurityPolicy::gatherReportURIs(DOMStringList& list) const

{

    for (size_t i = 0; i < m_policies.size(); ++i)

@@void ContentSecurityPolicy::reportInvalidSandboxFlags(const String& invalidFlags

    logToConsole("Error while parsing the 'sandbox' Content Security Policy directive: " + invalidFlags);

}

void ContentSecurityPolicy::reportInvalidReflectedXSS(const String& invalidValue) const

{

    logToConsole("The 'reflected-xss' Content Security Policy directive has the invalid value \"" + invalidValue + "\". Value values are \"allow\", \"filter\", and \"block\".");

}

void ContentSecurityPolicy::reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const

{

    String message = makeString("The value for Content Security Policy directive '", directiveName, "' contains an invalid character: '", value, "'. Non-whitespace characters outside ASCII 0x21-0x7E must be percent-encoded, as described in RFC 3986, section 2.1: http://tools.ietf.org/html/rfc3986#section-2.1.");

Source/WebCore/page/ContentSecurityPolicy.h

@@public:

        SuppressReport

    };

    enum ReflectedXSSDisposition {

        ReflectedXSSUnset = 0,

        AllowReflectedXSS,

        ReflectedXSSInvalid,

        FilterReflectedXSS,

        BlockReflectedXSS

    };

    void didReceiveHeader(const String&, HeaderType);

    // These functions are wrong because they assume that there is only one header.

@@public:

    bool allowConnectToSource(const KURL&, ReportingStatus = SendReport) const;

    bool allowFormAction(const KURL&, ReportingStatus = SendReport) const;

107 ReflectedXSSDisposition reflectedXSSDisposition() const;

108

    void setOverrideAllowInlineStyle(bool);

    bool isActive() const;

@@public:

    void reportInvalidPluginTypes(const String&) const;

    void reportInvalidSandboxFlags(const String&) const;

    void reportInvalidSourceExpression(const String& directiveName, const String& source) const;

122 void reportInvalidReflectedXSS(const String&) const;

    void reportUnsupportedDirective(const String&) const;

    void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;

Source/WebCore/platform/network/HTTPParsers.cpp

#include "config.h"

#include "HTTPParsers.h"

36#include "ContentSecurityPolicy.h"

#include <wtf/DateMath.h>

#include <wtf/text/CString.h>

#include <wtf/text/StringBuilder.h>

@@void findCharsetInMediaType(const String& mediaType, unsigned int& charsetPos, u

    }

}

343 XSS~~Protection~~Disposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)

344ContentSecurityPolicy::ReflectedXSSDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)

{

    DEFINE_STATIC_LOCAL(String, failureReasonInvalidToggle, (ASCIILiteral("expected 0 or 1")));

    DEFINE_STATIC_LOCAL(String, failureReasonInvalidSeparator, (ASCIILiteral("expected semicolon")));

@@XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String&

    unsigned pos = 0;

    if (!skipWhiteSpace(header, pos, false))

357 return XSS~~ProtectionEnabled~~;

358 return ContentSecurityPolicy::ReflectedXSSUnset;

358359

359360 if (header[pos] == '0')

360 return XSS~~ProtectionDisabled~~;

361 return ContentSecurityPolicy::AllowReflectedXSS;

    if (header[pos++] != '1') {

        failureReason = failureReasonInvalidToggle;

364 return XSS~~Protection~~Invalid;

365 return ContentSecurityPolicy::ReflectedXSSInvalid;

365366 }

366367

367 XSS~~Protection~~Disposition result = XSS~~ProtectionEnabled~~;

368 ContentSecurityPolicy::ReflectedXSSDisposition result = ContentSecurityPolicy::FilterReflectedXSS;

    bool modeDirectiveSeen = false;

    bool reportDirectiveSeen = false;

@@XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String&

        if (header[pos++] != ';') {

            failureReason = failureReasonInvalidSeparator;

            failurePosition = pos;

379 return XSS~~Protection~~Invalid;

380 return ContentSecurityPolicy::ReflectedXSSInvalid;

        }

        if (!skipWhiteSpace(header, pos, false))

@@XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String&

            if (modeDirectiveSeen) {

                failureReason = failureReasonDuplicateMode;

                failurePosition = pos;

390 return XSS~~Protection~~Invalid;

391 return ContentSecurityPolicy::ReflectedXSSInvalid;

            }

            modeDirectiveSeen = true;

            if (!skipEquals(header, pos)) {

                failureReason = failureReasonInvalidEquals;

                failurePosition = pos;

396 return XSS~~Protection~~Invalid;

397 return ContentSecurityPolicy::ReflectedXSSInvalid;

            }

            if (!skipToken(header, pos, "block")) {

                failureReason = failureReasonInvalidMode;

                failurePosition = pos;

401 return XSS~~Protection~~Invalid;

402 return ContentSecurityPolicy::ReflectedXSSInvalid;

402403 }

403 result = ~~XSSPr~~otect~~ion~~Block~~Enab~~led;

404 result = ContentSecurityPolicy::BlockReflectedXSS;

        } else if (skipToken(header, pos, "report")) {

            if (reportDirectiveSeen) {

                failureReason = failureReasonDuplicateReport;

                failurePosition = pos;

408 return XSS~~Protection~~Invalid;

409 return ContentSecurityPolicy::ReflectedXSSInvalid;

            }

            reportDirectiveSeen = true;

            if (!skipEquals(header, pos)) {

                failureReason = failureReasonInvalidEquals;

                failurePosition = pos;

414 return XSS~~Protection~~Invalid;

415 return ContentSecurityPolicy::ReflectedXSSInvalid;

            }

            size_t startPos = pos;

            if (!skipValue(header, pos)) {

                failureReason = failureReasonInvalidReport;

                failurePosition = pos;

420 return XSS~~Protection~~Invalid;

421 return ContentSecurityPolicy::ReflectedXSSInvalid;

            }

            reportURL = header.substring(startPos, pos - startPos);

            failurePosition = startPos; // If later semantic check deems unacceptable.

        } else {

            failureReason = failureReasonInvalidDirective;

            failurePosition = pos;

427 return XSS~~Protection~~Invalid;

428 return ContentSecurityPolicy::ReflectedXSSInvalid;

Source/WebCore/platform/network/HTTPParsers.h

#ifndef HTTPParsers_h

#define HTTPParsers_h

34#include "ContentSecurityPolicy.h"

#include <wtf/Forward.h>

#include <wtf/Vector.h>

@@namespace WebCore {

class HTTPHeaderMap;

class ResourceResponseBase;

enum XSSProtectionDisposition {

    XSSProtectionInvalid,

    XSSProtectionDisabled,

    XSSProtectionEnabled,

    XSSProtectionBlockEnabled

};

typedef enum {

    ContentDispositionNone,

    ContentDispositionInline,

@@String filenameFromHTTPContentDisposition(const String&);

String extractMIMETypeFromMediaType(const String&);

String extractCharsetFromMediaType(const String&); 

void findCharsetInMediaType(const String& mediaType, unsigned int& charsetPos, unsigned int& charsetLen, unsigned int start = 0);

71 XSS~~Protection~~Disposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL);

65ContentSecurityPolicy::ReflectedXSSDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL);

String extractReasonPhraseFromHTTPStatusLine(const String&);

// -1 could be set to one of the return parameters to indicate the value is not specified.

LayoutTests/ChangeLog

2013-02-13  Mike West  <mkwst@chromium.org>

        CSP 1.1: Experiment with 'reflected-xss' directive.

        https://bugs.webkit.org/show_bug.cgi?id=104479

        Reviewed by NOBODY (OOPS!).

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html: Added.

        * http/tests/security/contentSecurityPolicy/resources/reflected-xss-and-xss-protection.js: Added.

        (testMixedHeader):

        (frameLoaded):

        (frameErrored):

        * http/tests/security/xssAuditor/resources/echo-intertag.pl:

2013-02-13  Ádám Kallai  <kadam@inf.u-szeged.hu>

        [Qt] Unreviewed gardening. Skip failing tests.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow-expected.txt

ALERT: XSS

Tests that 'X-WebKit-CSP: reflected-xss allow;' disables the XSSAuditor. This test passes if an alert is generated, and the script is allowed.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html

<!DOCTYPE html>

<html>

<head>

    <script>

        if (window.testRunner) {

            testRunner.dumpAsText();

            testRunner.setXSSAuditorEnabled(true);

        }

    </script>

</head>

<body>

    <p>Tests that 'X-WebKit-CSP: reflected-xss allow;' disables the XSSAuditor.

    This test passes if an alert is generated, and the script is allowed.</p>

    <iframe src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?csp=allow&amp;q=<script>alert(String.fromCharCode(0x58,0x53,0x53))</script>"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow-expected.txt

ALERT: XSS

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=allow&disable-protection=1 into the IFrame.

Testing behavior when "reflected-xss" is set to allow, and "X-XSS-Protection" is set to allow.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('allow', 'allow');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to allow, and "X-XSS-Protection" is set to block.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('allow', 'block');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=allow&valid-header=2 into the IFrame.

Testing behavior when "reflected-xss" is set to allow, and "X-XSS-Protection" is set to filter.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('allow', 'filter');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid-expected.txt

CONSOLE MESSAGE: line 1: Error parsing header X-XSS-Protection: 12345678901234567: expected semicolon at character position 2. The default protections will be applied.

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=allow&malformed-header=1 into the IFrame.

Testing behavior when "reflected-xss" is set to allow, and "X-XSS-Protection" is set to invalid.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('allow', 'invalid');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset-expected.txt

ALERT: XSS

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=allow into the IFrame.

Testing behavior when "reflected-xss" is set to allow, and "X-XSS-Protection" is set to unset.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('allow', 'unset');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to block, and "X-XSS-Protection" is set to allow.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('block', 'allow');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to block, and "X-XSS-Protection" is set to block.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('block', 'block');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to block, and "X-XSS-Protection" is set to filter.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('block', 'filter');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid-expected.txt

CONSOLE MESSAGE: line 1: Error parsing header X-XSS-Protection: 12345678901234567: expected semicolon at character position 2. The default protections will be applied.

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to block, and "X-XSS-Protection" is set to invalid.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('block', 'invalid');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to block, and "X-XSS-Protection" is set to unset.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('block', 'unset');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter&disable-protection=1 into the IFrame.

Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to allow.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('filter', 'allow');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to block.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('filter', 'block');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter&valid-header=2 into the IFrame.

Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to filter.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('filter', 'filter');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid-expected.txt

CONSOLE MESSAGE: line 1: Error parsing header X-XSS-Protection: 12345678901234567: expected semicolon at character position 2. The default protections will be applied.

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter&malformed-header=1 into the IFrame.

Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to invalid.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('filter', 'invalid');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter into the IFrame.

Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to unset.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('filter', 'unset');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=invalid&disable-protection=1 into the IFrame.

Testing behavior when "reflected-xss" is set to invalid, and "X-XSS-Protection" is set to allow.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('invalid', 'allow');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to invalid, and "X-XSS-Protection" is set to block.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('invalid', 'block');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=invalid&valid-header=2 into the IFrame.

Testing behavior when "reflected-xss" is set to invalid, and "X-XSS-Protection" is set to filter.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('invalid', 'filter');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 1: Error parsing header X-XSS-Protection: 12345678901234567: expected semicolon at character position 2. The default protections will be applied.

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=invalid&malformed-header=1 into the IFrame.

Testing behavior when "reflected-xss" is set to invalid, and "X-XSS-Protection" is set to invalid.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('invalid', 'invalid');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=invalid into the IFrame.

Testing behavior when "reflected-xss" is set to invalid, and "X-XSS-Protection" is set to unset.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('invalid', 'unset');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow-expected.txt

ALERT: XSS

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&disable-protection=1 into the IFrame.

Testing behavior when "reflected-xss" is set to unset, and "X-XSS-Protection" is set to allow.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('unset', 'allow');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded about:blank into the IFrame.

Testing behavior when "reflected-xss" is set to unset, and "X-XSS-Protection" is set to block.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('unset', 'block');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&valid-header=2 into the IFrame.

Testing behavior when "reflected-xss" is set to unset, and "X-XSS-Protection" is set to filter.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('unset', 'filter');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid-expected.txt

CONSOLE MESSAGE: line 1: Error parsing header X-XSS-Protection: 12345678901234567: expected semicolon at character position 2. The default protections will be applied.

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&malformed-header=1 into the IFrame.

Testing behavior when "reflected-xss" is set to unset, and "X-XSS-Protection" is set to invalid.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('unset', 'invalid');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E into the IFrame.

Testing behavior when "reflected-xss" is set to unset, and "X-XSS-Protection" is set to unset.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html

<!DOCTYPE html>

<html>

<body>

    <script src='../resources/reflected-xss-and-xss-protection.js'></script>

    <script>testMixedHeader('unset', 'unset');</script>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

Tests that 'X-WebKit-CSP: reflected-xss block;' enables the XSSAuditor. This test passes if a console message is generated, and the page is blocked. There should be no content in the IFrame below:

--------

Frame: 'frame'

--------

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html

<!DOCTYPE html>

<html>

<head>

    <script src="http://localhost:8000/security/xssAuditor/resources/utilities.js"></script>

    <script>

        if (window.testRunner) {

            testRunner.dumpAsText();

            testRunner.dumpChildFramesAsText();

            testRunner.waitUntilDone();

            testRunner.setXSSAuditorEnabled(true);

        }

    </script>

</head>

<body>

    <p>Tests that 'X-WebKit-CSP: reflected-xss block;' enables the XSSAuditor.

    This test passes if a console message is generated, and the page is blocked.

    There should be no content in the IFrame below:</p>

    <iframe id="frame"

            onload="checkIfFrameLocationMatchesURLAndCallDone('frame', 'about:blank')"

            src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?csp=block&amp;q=<script>alert(String.fromCharCode(0x58,0x53,0x53))</script>"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

Tests that 'X-WebKit-CSP: reflected-xss' enables the XSSAuditor. This test passes if a console message is generated, and the script is blocked.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html

<!DOCTYPE html>

<html>

<head>

    <script>

        if (window.testRunner) {

            testRunner.dumpAsText();

            testRunner.setXSSAuditorEnabled(true);

        }

    </script>

</head>

<body>

    <p>Tests that 'X-WebKit-CSP: reflected-xss' enables the XSSAuditor.

    This test passes if a console message is generated, and the script is blocked.</p>

    <iframe src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?csp=_empty_&amp;q=<script>alert(String.fromCharCode(0x58,0x53,0x53))</script>"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter-expected.txt

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

Tests that 'X-WebKit-CSP: reflected-xss filter;' enables the XSSAuditor. This test passes if a console message is generated, and the script is blocked.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html

<!DOCTYPE html>

<html>

<head>

    <script>

        if (window.testRunner) {

            testRunner.dumpAsText();

            testRunner.setXSSAuditorEnabled(true);

        }

    </script>

</head>

<body>

    <p>Tests that 'X-WebKit-CSP: reflected-xss filter;' enables the XSSAuditor.

    This test passes if a console message is generated, and the script is blocked.</p>

    <iframe src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?csp=filter&amp;q=<script>alert(String.fromCharCode(0x58,0x53,0x53))</script>"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "invalid". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: line 4: Refused to execute a JavaScript script. Source code of script found within request.

Tests that 'X-WebKit-CSP: reflected-xss invalid' enables the XSSAuditor. This test passes if a console message is generated, and the script is allowed.

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html

<!DOCTYPE html>

<html>

<head>

    <script>

        if (window.testRunner) {

            testRunner.dumpAsText();

            testRunner.setXSSAuditorEnabled(true);

        }

    </script>

</head>

<body>

    <p>Tests that 'X-WebKit-CSP: reflected-xss invalid' enables the XSSAuditor.

    This test passes if a console message is generated, and the script is allowed.</p>

    <iframe src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?csp=invalid&amp;q=<script>alert(String.fromCharCode(0x58,0x53,0x53))</script>"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing-expected.txt

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "blah". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "allow blah". Value values are "allow", "filter", and "block".

CONSOLE MESSAGE: The 'reflected-xss' Content Security Policy directive has the invalid value "blah allow". Value values are "allow", "filter", and "block".

Invalid 'reflected-xss' headers should generate console messages.

--------

Frame: '<!--framePath //<!--frame0-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame1-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame2-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame3-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame4-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame5-->-->'

--------

PASS

--------

Frame: '<!--framePath //<!--frame6-->-->'

--------

PASS

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html

<!DOCTYPE html>

<html>

<head>

    <script src='../resources/multiple-iframe-test.js'></script>

    <script>

        var tests = [

            ['yes', 'reflected-xss allow', 'resources/script.js'],

            ['yes', 'reflected-xss filter', 'resources/script.js'],

            ['yes', 'reflected-xss block', 'resources/script.js'],

            ['yes', 'reflected-xss', 'resources/script.js'],

            ['yes', 'reflected-xss blah', 'resources/script.js'],

            ['yes', 'reflected-xss allow blah', 'resources/script.js'],

            ['yes', 'reflected-xss blah allow', 'resources/script.js'],

        ];

    </script>

</head>

<body onload="testExperimentalPolicy()">

    <p>

        Invalid 'reflected-xss' headers should generate console messages.

    </p>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/resources/reflected-xss-and-xss-protection.js

if (window.testRunner) {

    testRunner.dumpAsText();

    testRunner.setXSSAuditorEnabled(true);

    testRunner.waitUntilDone();

}

function testMixedHeader(csp, xssProtection) {

    var params = [

        'q=<script>alert(String.fromCharCode(0x58,0x53,0x53))<' + '/script>'

    ];

    if (csp != 'unset')

        params.push('csp='+csp);

    if (xssProtection == 'allow')

        params.push('disable-protection=1');

    if (xssProtection == 'block')

        params.push('enable-full-block=1');

    if (xssProtection == 'filter')

        params.push('valid-header=2');

    if (xssProtection == 'invalid')

        params.push('malformed-header=1');

    var url = '/security/xssAuditor/resources/echo-intertag.pl?';

    url += params.join('&amp;');

    document.write('<p>Testing behavior when "reflected-xss" is set to ' + csp + ', and "X-XSS-Protection" is set to ' + xssProtection + '.');

    document.write('<iframe src="' + url + '" onload="frameLoaded()" onerror="frameErrored()"></iframe>');

}

function frameLoaded() {

    var frame = document.querySelector('iframe');

    alert('Loaded ' + frame.contentWindow.location + ' into the IFrame.');

    testRunner.notifyDone();

}

function frameErrored() {

    alert('Error loading document into the IFrame.');

}

LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag.pl

@@if ($cgi->param('malformed-header') == 9) {

    print "X-XSS-Protection: 1; mode=block; report=/fail; report=/fail;\n";

}

if ($cgi->param('csp') eq '_empty_') {

    print "X-WebKit-CSP: reflected-xss\n";

} elsif ($cgi->param('csp')) {

    print "X-WebKit-CSP: reflected-xss " . $cgi->param('csp') . "\n";

}

print "Content-Type: text/html; charset=";

print $cgi->param('charset') ? $cgi->param('charset') : "UTF-8";

print "\n\n";