Bug 58643 – CSP frame-src is missing

• Component: Tools / Tests
• Status: RESOLVED FIXED

[Adam Barth]

CSP frame-src is missing

[Adam Barth]

Created attachment 90377 [details]
Patch

[Adam Barth]

EWS failures expected because this patch depends on Bug 58646.

[Eric Seidel (no email)]

Comment on attachment 90377 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=90377&action=review

LGTM.  You said you were gonna make the message reporting hotter before landing.

> Source/WebCore/html/HTMLFrameElementBase.cpp:81
> +    // the Content-Security-Policy of the parent frame or the requestor.

requester?

[Adam Barth]

Created attachment 90417 [details]
Patch

[Adam Barth]

Created attachment 90480 [details]
Patch for landing

[WebKit Commit Bot]

The commit-queue encountered the following flaky tests while processing attachment 90480 [details]:

http/tests/xmlhttprequest/remember-bad-password.html bug 51733 (author: [e-mail])
The commit-queue is continuing to process your patch.

[WebKit Commit Bot]

Comment on attachment 90480 [details]
Patch for landing

Clearing flags on attachment: 90480

Committed r84460: <http://trac.webkit.org/changeset/84460>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Review Bot]

http://trac.webkit.org/changeset/84460 might have broken Qt Linux Release

[Csaba Osztrogonác]

(In reply to comment #9)
> http://trac.webkit.org/changeset/84460 might have broken Qt Linux Release

http/tests/security/contentSecurityPolicy/frame-src-blocked.html 
broke http/tests/security/contentSecurityPolicy/image-allowed.html
on Qt bot, on Win7 release test bot and on Windows XP debug test bot

--- /home/webkitbuildbot/slaves/release32bit/buildslave/qt-linux-release/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-expected.txt	2011-04-21 02:50:47.567542636 -0700
+++ /home/webkitbuildbot/slaves/release32bit/buildslave/qt-linux-release/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-actual.txt	2011-04-21 02:50:47.567542636 -0700
@@ -1,2 +1,4 @@
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
+
 ALERT: PASS


--- /home/buildbot/slave/WebKit-BuildSlave/win-release-tests/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-expected.txt	2011-04-21 03:36:29.043649200 -0700
+++ /home/buildbot/slave/WebKit-BuildSlave/win-release-tests/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-actual.txt	2011-04-21 03:36:29.041649100 -0700
@@ -1,2 +1,6 @@
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
+
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
+
 ALERT: PASS
 

--- /home/buildbot/slave/win-debug-tests/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-expected.txt	2011-04-21 19:26:48.328125000 -0700
+++ /home/buildbot/slave/win-debug-tests/build/layout-test-results/http/tests/security/contentSecurityPolicy/image-allowed-actual.txt	2011-04-21 19:26:48.328125000 -0700
@@ -1,2 +1,6 @@
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
+
+CONSOLE MESSAGE: line 1: Refused to load frame from 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/alert-fail.html' because of Content-Security-Policy.
+
 ALERT: PASS

[Csaba Osztrogonác]

I tried to rollout but unfortunately it conflicts with r84478.

[Adam Barth]

(In reply to comment #11)
> I tried to rollout but unfortunately it conflicts with r84478.

I've performed a partial rollout.  Sorry for the disruption.  :(

[Adam Barth]

Created attachment 90725 [details]
Patch

[Eric Seidel (no email)]

Comment on attachment 90725 [details]
Patch

We need to figure out how to unify these checks.  This ends up being a bunch of copy/paste code, which someone else editing this is likely to get wrong.

[Adam Barth]

Comment on attachment 90725 [details]
Patch

I think we should have contentSecurityPolicy call canDisplay, which would simply all these call sites.

[Eric Seidel (no email)]

(In reply to comment #15)
> (From update of attachment 90725 [details])
> I think we should have contentSecurityPolicy call canDisplay, which would simply all these call sites.

If you'd file the follow-up when you get the chance, that'd be fantastic.  Thanks again for the patch.

[WebKit Commit Bot]

The commit-queue encountered the following flaky tests while processing attachment 90725 [details]:

http/tests/misc/favicon-loads-with-icon-loading-override.html bug 58412 (author: [e-mail])
The commit-queue is continuing to process your patch.

[WebKit Commit Bot]

Comment on attachment 90725 [details]
Patch

Clearing flags on attachment: 90725

Committed r84681: <http://trac.webkit.org/changeset/84681>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Commit Bot]

The commit-queue encountered the following flaky tests while processing attachment 90725 [details]:

http/tests/inspector/console-websocket-error.html bug 57392 (authors: [e-mail] and [e-mail])
The commit-queue is continuing to process your patch.

[WebKit Review Bot]

http://trac.webkit.org/changeset/84681 might have broken GTK Linux 64-bit Debug