ChangeLog

2013-04-09  Geoffrey Garen  <ggaren@apple.com>

        [JSC] Script run from an isolated world should bypass a page's CSP

        https://bugs.webkit.org/show_bug.cgi?id=100815

        Reviewed by NOBODY (OOPS!).

        No new tests (OOPS!).

        * bindings/js/ScriptController.cpp:

        (WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy):

        * bindings/js/ScriptController.h: Test the current caller's DOM wrapper

        world to decide whether CSP should be enforced.

        Like most of CSP, this is a stupid policy because it doesn't address

        second-order effects like <script> parsing or event handler execution,

        which might be triggered indirectly by privileged scripts. These indirect

        effects are still broken. Oh well.

2013-04-09  Benjamin Poulain  <bpoulain@apple.com>

        Remove chromium exceptions from WebCore's gitattributes

148074

Source/WebCore/bindings/js/ScriptController.cpp

@@ScriptValue ScriptController::executeScr

    return evaluateInWorld(sourceCode, world);

}

bool ScriptController::shouldBypassMainWorldContentSecurityPolicy()

{

    CallFrame* callFrame = JSDOMWindow::commonJSGlobalData()->topCallFrame;

    if (!callFrame || callFrame == CallFrame::noCaller()) 

        return false;

    DOMWrapperWorld* domWrapperWorld = currentWorld(callFrame);

    if (domWrapperWorld->isNormal())

        return false;

    return true;

}

474485} // namespace WebCore

147962

Source/WebCore/bindings/js/ScriptController.h

@@public:

    NPObject* windowScriptNPObject();

#endif

166 // FIXME: Script run from an isolated world should bypass a page's CSP. http://webkit.org/b/100815

167 bool shouldBypassMainWorldContentSecurityPolicy() { return false; }

166 bool shouldBypassMainWorldContentSecurityPolicy();

private:

    JSDOMWindowShell* initScript(DOMWrapperWorld* world);

147962

LayoutTests/ChangeLog

2013-04-09  Geoffrey Garen  <ggaren@apple.com>

        [JSC] Script run from an isolated world should bypass a page's CSP

        https://bugs.webkit.org/show_bug.cgi?id=100815

        Reviewed by NOBODY (OOPS!).

        Enabled these tests, now that they pass.

        I removed all the nonsense in these tests about setting an isolated world's

        CSP and origin manually, since we have no use for those features.

        * http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt:

        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt:

        * http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html:

        * http/tests/security/isolatedWorld/bypass-main-world-csp.html:

        * platform/efl/TestExpectations:

        * platform/mac/TestExpectations:

        * platform/qt/TestExpectations:

        * platform/win/TestExpectations:

2013-04-09  Adam Klein  <adamk@chromium.org>

        Update Document's event listener type bitfield when adopting a Node

148074

LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-expected.txt

CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".

ALERT: BLOCKED in main world

CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".

ALERT: BLOCKED in isolated world

ALERT: Starting to bypass main world's CSP:

84ALERT: LOADED in isolated world

CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".

ALERT: BLOCKED in main world

This test ensures that scripts run in isolated worlds marked with their own Content Security Policy aren't affected by the page's content security policy. Extensions, for example, should be able to load any resource they like.

5This test ensures that scripts run in isolated worlds aren't affected by the page's content security policy. Extensions, for example, should be able to load any resource they like.

136

147

147962

LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt

11CONSOLE MESSAGE: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt' because it violates the following Content Security Policy directive: "connect-src 'none'".

22

CONSOLE MESSAGE: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt' because it violates the following Content Security Policy directive: "connect-src 'none'".

CONSOLE MESSAGE: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt' because it violates the following Content Security Policy directive: "connect-src 'none'".

CONSOLE MESSAGE: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/cross-origin-xhr.txt' because it violates the following Content Security Policy directive: "connect-src 'none'".

Tests that isolated worlds can have XHRs that the page's CSP wouldn't allow.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

@@On success, you will see a series of "PA

XHR from main world

PASS: XHR.open threw an exception.

XHR from isolated world with unchanged CSP

PASS: XHR.open threw an exception.

XHR from isolated world with same security origin as XHR target.

PASS: XHR.open threw an exception.

XHR from isolated world with same security origin as XHR target, and looser CSP.

10XHR from isolated world

2111PASS: XHR.open did not throw an exception.

22 XHR from main world is not affected by the isolated world origin or CSP

23 PASS: XHR.open threw an exception.

PASS successfullyParsed is true

TEST COMPLETE

147962

LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html

@@var tests = [

        xhr(true);

    },

    function() {

20 debug('XHR from isolated world ~~with unchanged CSP~~');

21 runTestInWorld(1, 'xhr', '~~tru~~e');

20 debug('XHR from isolated world');

21 runTestInWorld(1, 'xhr', 'false');

2222 },

    function() {

        debug('XHR from isolated world with same security origin as XHR target.');

        testRunner.setIsolatedWorldSecurityOrigin(2, 'http://localhost:8000');

        runTestInWorld(2, 'xhr', 'true');

    },

    function() {

        debug('XHR from isolated world with same security origin as XHR target, and looser CSP.');

        testRunner.setIsolatedWorldContentSecurityPolicy(3, 'connect-src *');

        testRunner.setIsolatedWorldSecurityOrigin(3, 'http://localhost:8000');

        runTestInWorld(3, 'xhr', 'false');

    },

    function() {

        debug('XHR from main world is not affected by the isolated world origin or CSP');

        xhr(true);

    }

];

var currentTest = 0;

@@if (window.testRunner) {

            switch (message.type) {

                case 'test-done':

                    currentTest++;

                    if (currentTest == tests.length) {

                        testRunner.setIsolatedWorldSecurityOrigin(1, null);

                        testRunner.setIsolatedWorldSecurityOrigin(2, null);

                        testRunner.setIsolatedWorldSecurityOrigin(3, null);

                        testRunner.setIsolatedWorldContentSecurityPolicy(1, '');

                        testRunner.setIsolatedWorldContentSecurityPolicy(2, '');

                        testRunner.setIsolatedWorldContentSecurityPolicy(3, '');

35 if (currentTest == tests.length)

5736 finishJSTest();

58 }

                    else

                        tests[currentTest]();

                    break;

147962

LayoutTests/http/tests/security/isolatedWorld/bypass-main-world-csp.html

        testRunner.waitUntilDone();

    }

11 tests = 4;

11 tests = 2;

    window.addEventListener("message", function(message) {

        tests -= 1;

        test();

        }

        switch (tests) {

            case 4:

                setImgSrc(false);

                break;

            case 3:

                testRunner.evaluateScriptInIsolatedWorld(1, String(eval("setImgSrc")) + "\nsetImgSrc(true);");

                break;

3933 case 2:

                alert("Starting to bypass main world's CSP:");

                testRunner.setIsolatedWorldContentSecurityPolicy(1, 'img-src *');

                testRunner.evaluateScriptInIsolatedWorld(1, String(eval("setImgSrc")) + "\nsetImgSrc(true);");

34 setImgSrc(false);

4335 break;

4436 case 1:

45 setImgSrc(~~fals~~e);

37 testRunner.evaluateScriptInIsolatedWorld(1, String(eval("setImgSrc")) + "\nsetImgSrc(true);");

4638 break;

4739 case 0:

48 testRunner.setIsolatedWorldContentSecurityPolicy(1, '');

                testRunner.notifyDone();

                break;

        }

</head>

<body onload='test();'>

    <p>

        This test ensures that scripts run in isolated worlds marked with their

        own Content Security Policy aren't affected by the page's content

        security policy. Extensions, for example, should be able to load any

        resource they like.

        This test ensures that scripts run in isolated worlds aren't affected

        by the page's content security policy. Extensions, for example, should

        be able to load any resource they like.

    </p>

</body>

</html>

147962

LayoutTests/platform/efl/TestExpectations

@@webkit.org/b/61540 http/tests/security/i

webkit.org/b/61540 inspector/extensions/extensions-audits-content-script.html [ Failure ]

webkit.org/b/61540 inspector/extensions/extensions-eval-content-script.html [ Failure ]

# JSC also doesn't support setIsolatedWorldContentSecurityPolicy

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp.html [ Failure ]

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html [ Failure ]

#__worldID is undefined in isolated world

Bug(EFL) http/tests/security/isolatedWorld/didClearWindowObject.html

147962

LayoutTests/platform/mac/TestExpectations

@@fast/xsl/xslt-processor-template.html

# JSC does not support setIsolatedWorldSecurityOrigin (http://webkit.org/b/61540)

http/tests/security/isolatedWorld/cross-origin-xhr.html

# JSC also doesn't support setIsolatedWorldContentSecurityPolicy (webkit.org/b/100815)

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp.html [ Failure ]

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html [ Failure ]

# https://bugs.webkit.org/show_bug.cgi?id=63282 layerTreeAsText doesn't work for iframes

compositing/rtl/rtl-iframe-absolute-overflow-scrolled.html

compositing/rtl/rtl-iframe-absolute-overflow.html

147962

LayoutTests/platform/qt/TestExpectations

@@fast/js/i18n-bindings-locale.html

# JSC does not support setIsolatedWorldSecurityOrigin, (http://webkit.org/b/61540)

http/tests/security/isolatedWorld/cross-origin-xhr.html

# JSC also doesn't support setIsolatedWorldContentSecurityPolicy (webkit.org/b/100815)

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp.html

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html

# This test is for clients that choose to make the missing plugin indicator a button

plugins/clicking-missing-plugin-fires-delegate.html

147962

LayoutTests/platform/win/TestExpectations

@@loader/navigation-while-deferring-loads.

# JSC does not support setIsolatedWorldSecurityOrigin (http://webkit.org/b/61540)

http/tests/security/isolatedWorld/cross-origin-xhr.html

# JSC also doesn't support setIsolatedWorldContentSecurityPolicy (webkit.org/b/100815)

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp.html [ Failure ]

webkit.org/b/100815 http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr.html [ Failure ]

# ENABLE(WEBGL) is disabled

compositing/backface-visibility/backface-visibility-webgl.html

compositing/visibility/visibility-simple-webgl-layer.html

147962