Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c5a36846f1963ea20839faf2d9b0c70e6ecde564
https://github.com/WebKit/WebKit/commit/c5a36846f1963ea20839faf2d9b0c70e6ecde564
Author: Ryan Reno <rr...@apple.com>
Date: 2022-09-20 (Tue, 20 Sep 2022)
Changed paths:
M LayoutTests/TestExpectations
M
LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt
M
LayoutTests/http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/script-tag.http-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/script-tag.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/script-tag.http-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/script-tag.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/blob-url-inherits-from-initiator.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/history-iframe.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/history.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt
R
LayoutTests/platform/glib/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt
A
LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt
A
LayoutTests/platform/mac/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/SecurityContext.cpp
M Source/WebCore/dom/SecurityContext.h
M Source/WebCore/history/HistoryItem.h
M Source/WebCore/loader/CrossOriginOpenerPolicy.cpp
M Source/WebCore/loader/DocumentLoader.cpp
M Source/WebCore/loader/DocumentWriter.cpp
M Source/WebCore/loader/DocumentWriter.h
M Source/WebCore/loader/NavigationRequester.cpp
M Source/WebCore/loader/NavigationRequester.h
M Source/WebCore/loader/PolicyContainer.h
M Source/WebCore/page/csp/ContentSecurityPolicy.cpp
M Source/WebCore/page/csp/ContentSecurityPolicy.h
M Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h
Log Message:
-----------
Adhere to policy inheritance according to policy container
https://bugs.webkit.org/show_bug.cgi?id=224745
rdar://96067238
Reviewed by Chris Dumez.
This modifies our implementation of CSP inheritance when navigating to local
schemes by using the PolicyContainer[1].
We now keep track of the initiating document's policies and store the policies
in history, if applicable.
[1] https://html.spec.whatwg.org/multipage/origin.html#policy-containers
* LayoutTests/TestExpectations:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/script-tag.http-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/script-tag.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/script-tag.http-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/script-tag.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/blob-url-inherits-from-initiator.sub-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/history-iframe.sub-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/history.sub-expected.txt:
*
LayoutTests/platform/glib/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt:
Removed.
*
LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt:
*
LayoutTests/http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt:
*
LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt:
Copied from
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt.
*
LayoutTests/platform/mac/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt:
Copied from
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt.
Rebaselined tests. New platform-specific expectations are because Apple
platforms fail tests that gtk-wk2 passes.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::inheritPolicyContainerFrom):
(WebCore::Document::crossOriginOpenerPolicy const):
(WebCore::Document::setReferrerPolicy): Deleted.
(WebCore::Document::setCrossOriginOpenerPolicy): Deleted.
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/SecurityContext.cpp:
(WebCore::SecurityContext::setReferrerPolicy):
(WebCore::SecurityContext::policyContainer const):
(WebCore::SecurityContext::inheritPolicyContainerFrom):
* Source/WebCore/dom/SecurityContext.h:
(WebCore::SecurityContext::setCrossOriginOpenerPolicy):
(WebCore::SecurityContext::referrerPolicy const):
(WebCore::SecurityContext::inheritPolicyContainerFrom):
These changes reorganize the security policies to be
owned by the SecurityContext. This moves the getters/setters
and adds an inheritance API.
* Source/WebCore/history/HistoryItem.h:
(WebCore::HistoryItem::policyContainer const):
(WebCore::HistoryItem::setPolicyContainer):
These changes support adding policy container to history,
if applicable.
* Source/WebCore/loader/CrossOriginOpenerPolicy.cpp:
(WebCore::computeResponseOriginAndCOOP):
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::commitData):
* Source/WebCore/loader/DocumentWriter.cpp:
(WebCore::DocumentWriter::begin):
* Source/WebCore/loader/DocumentWriter.h:
(WebCore::DocumentWriter::begin):
Optionally pass the NavigationAction which
triggered the load into the DocumentWriter so
policies can be inherited if needed.
* Source/WebCore/loader/NavigationRequester.cpp:
(WebCore::NavigationRequester::from):
* Source/WebCore/loader/NavigationRequester.h:
(WebCore::NavigationRequester::encode const):
(WebCore::NavigationRequester::decode):
* Source/WebCore/loader/PolicyContainer.h:
(WebCore::PolicyContainer::isolatedCopy const):
(WebCore::PolicyContainer::isolatedCopy):
(WebCore::PolicyContainer::encode const):
(WebCore::PolicyContainer::decode):
These changes support the addition of CSP to the
PolicyContainer and add the PolicyContainer to the
NavigationRequester so it can be inherited, if needed.
* Source/WebCore/page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::inheritHeadersFrom):
* Source/WebCore/page/csp/ContentSecurityPolicy.h:
(WebCore::ContentSecurityPolicy::referrer const):
Since we store just the CSP List in the PolicyContainer
this adds an API for parsing the list into usable objects
when inheriting CSP.
* Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h:
(WebCore::operator==):
Changes to support addition to PolicyContainer.
Canonical link: https://commits.webkit.org/254679@main
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
