Attachment 343841 Details for Bug 187153 – Patch

[patch] Patch

bug-187153-20180628132111.patch (text/plain), 4.58 KB, created by youenn fablet on 2018-06-28 13:21:12 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: youenn fablet

Created: 2018-06-28 13:21:12 PDT

Size: 4.58 KB

patch

obsolete

>Subversion Revision: 233256
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 51b72c81c3e227443dacc555e0c8f5995ca72a88..3fdab7e9fc903d81f62fa7a6326b86b0afa41854 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,22 @@
>+2018-06-28  Youenn Fablet  <youenn@apple.com>
>+
>+        Early return when handling fetch event in case service worker origin does not match origin of a subresource load
>+        https://bugs.webkit.org/show_bug.cgi?id=187153
>+        <rdar://problem/41329832>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Stop crashing the service worker process in case a subresource load origin is not matching a service worker origin.
>+        Instead, just return early so that the load will be handled by the network process.
>+
>+        Keep crashing in case a navigation load is not matching its service worker origin.
>+        Add more logging to help with the debugging.
>+
>+        * WebProcess/Storage/WebSWContextManagerConnection.cpp:
>+        (WebKit::logValidFetchError):
>+        (WebKit::isValidFetch):
>+        (WebKit::WebSWContextManagerConnection::startFetch):
>+
> 2018-06-28  Youenn Fablet  <youenn@apple.com>
> 
>         Handle the case of registerMDNSNameCallback called several times
>diff --git a/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp b/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
>index 2cfb3ca1d3cc2adf4f456cdce0f6477a57f204c4..c515a503e65c0d67972f56504f7d905f6bdb42d1 100644
>--- a/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
>+++ b/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
>@@ -183,21 +183,32 @@ void WebSWContextManagerConnection::serviceWorkerStartedWithMessage(std::optiona
>         m_connectionToStorageProcess->send(Messages::WebSWServerToContextConnection::ScriptContextFailedToStart(jobDataIdentifier, serviceWorkerIdentifier, exceptionMessage), 0);
> }
> 
>+static inline void logValidFetchError(const char* message, const URL& serviceWorkerURL, const URL& requestOriginURL)
>+{
>+    auto serviceWorkerPort = serviceWorkerURL.port() ? *serviceWorkerURL.port() : 0;
>+    auto requestOriginURLPort = requestOriginURL.port() ? *requestOriginURL.port() : 0;
>+    RELEASE_LOG_ERROR(ServiceWorker, "%{public}s: service worker is %{public}s://...:%d, request URL is %{public}s://...:%d", message, serviceWorkerURL.protocol().utf8().data(), serviceWorkerPort, requestOriginURL.protocol().utf8().data(), requestOriginURLPort);
>+}
>+
> static inline bool isValidFetch(const ResourceRequest& request, const FetchOptions& options, const URL& serviceWorkerURL, const String& referrer)
> {
>     // For exotic service workers, do not enforce checks.
>     if (!serviceWorkerURL.protocolIsInHTTPFamily())
>         return true;
> 
>-    if (options.mode == FetchOptions::Mode::Navigate)
>-        return protocolHostAndPortAreEqual(request.url(), serviceWorkerURL);
>+    if (options.mode == FetchOptions::Mode::Navigate && !protocolHostAndPortAreEqual(request.url(), serviceWorkerURL)) {
>+        logValidFetchError("Cannot intercept a navigation load that is not same-origin as the service worker URL", serviceWorkerURL, request.url());
>+        CRASH();
>+    }
> 
>     String origin = request.httpOrigin();
>     URL url { URL(), origin.isEmpty() ? referrer : origin };
>-    if (!url.protocolIsInHTTPFamily())
>-        return true;
>+    if (url.protocolIsInHTTPFamily() && !protocolHostAndPortAreEqual(url, serviceWorkerURL)) {
>+        logValidFetchError("Trying to intercept a non navigation load that is not originating from a same-origin context as the service worker URL", serviceWorkerURL, url);
>+        return false;
>+    }
> 
>-    return protocolHostAndPortAreEqual(url, serviceWorkerURL);
>+    return true;
> }
> 
> void WebSWContextManagerConnection::cancelFetch(SWServerConnectionIdentifier serverConnectionIdentifier, ServiceWorkerIdentifier serviceWorkerIdentifier, FetchIdentifier fetchIdentifier)
>@@ -214,7 +225,10 @@ void WebSWContextManagerConnection::startFetch(SWServerConnectionIdentifier serv
>         return;
>     }
> 
>-    RELEASE_ASSERT(isValidFetch(request, options, serviceWorkerThreadProxy->scriptURL(), referrer));
>+    if (!isValidFetch(request, options, serviceWorkerThreadProxy->scriptURL(), referrer)) {
>+        m_connectionToStorageProcess->send(Messages::StorageProcess::DidNotHandleFetch { serverConnectionIdentifier, fetchIdentifier }, 0);
>+        return;
>+    }
> 
>     auto client = WebServiceWorkerFetchTaskClient::create(m_connectionToStorageProcess.copyRef(), serviceWorkerIdentifier, serverConnectionIdentifier, fetchIdentifier);
>     std::optional<ServiceWorkerClientIdentifier> clientId;

Actions: View | Formatted Diff | Diff

Attachments on bug 187153: 343841 | 343850 | 343860