Skip to content

GitLab

T
tangled
Commit 2ac84deb authored by Andy Paicu's avatar Andy Paicu Committed by Commit Bot
Browse files
Options

Inherit the CSP of the entered document when using document.write/open 

Spec change in progress: https://github.com/whatwg/html/issues/4510

Bug: 920531
Change-Id: Idef348de028acbb400ae39ed5e9d058a2fc0173d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1545067
Commit-Queue: Andy Paicu <andypaicu@chromium.org>
Reviewed-by: default avatarMike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#658500}
parent 6b8cff68
Hide whitespace changes
Inline Side-by-side
Showing with 72 additions and 0 deletions
third_party/blink/renderer/core/dom/document.cc
View file @ 2ac84deb
......@@ -3060,6 +3060,9 @@ void Document::open(Document* entered_document,
// Change |document|'s URL to the URL of the responsible document specified
// by the entry settings object.
if (entered_document && this != entered_document) {
auto* csp = MakeGarbageCollected<ContentSecurityPolicy>();
csp->CopyStateFrom(entered_document->GetContentSecurityPolicy());
InitContentSecurityPolicy(csp);
// Clear the hash fragment from the inherited URL to prevent a
// scroll-into-view for any document.open()'d frame.
KURL new_url = entered_document->Url();
......
third_party/blink/web_tests/external/wpt/content-security-policy/inheritance/document-write-iframe.html 0 → 100644
View file @ 2ac84deb
<!DOCTYPE html>
<head>
<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
var t0 = async_test("Image loaded in srcdoc iframe using document.write is blocked");
var t1 = async_test("Image loaded in normal iframe using document.write is blocked");
var t2 = async_test("Image loaded directly in simple srcdoc iframe is blocked");
window.onmessage = function(e) {
var current_test;
if (e.data.type == "spv0") {
current_test = t0;
} else if (e.data.type == "spv1") {
current_test = t1;
} else if (e.data.type == "spv2") {
current_test = t2;
} else {
t0.step(function() {assert_true(false, "Unexpected message received from child frames")});
t1.step(function() {assert_true(false, "Unexpected message received from child frames")});
t2.step(function() {assert_true(false, "Unexpected message received from child frames")});
}
current_test.step(function() {
assert_equals(e.data.violatedDirective, 'img-src');
current_test.done();
});
}
</script>
<!--As discovered thanks to crbug.com/920531, there is a bug in CSP where the
CSP is not inherited when using document.open/document.write to edit a
document's contents. -->
<iframe id="frame1" srcdoc=""></iframe>
<!-- This is speculatively correct https://github.com/whatwg/html/issues/4510 -->
<iframe id="frame2" src="/content-security-policy/common/blank.html"></iframe>
<!--<script>
window.addEventListener('securitypolicyviolation', function(e) {
window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');
});
</script>
<img src='/content-security-policy/support/fail.png'>
-->
<iframe srcdoc="<script>window.addEventListener('securitypolicyviolation', function(e) {window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');});</script><img src='/content-security-policy/support/fail.png'>"></iframe>
<script>
var frames = ['frame1', 'frame2'];
for (var i = 0; i < frames.length; i++) {
var body_text = ['<script>',
' window.addEventListener("securitypolicyviolation", function(e) {',
' window.top.postMessage({type: "spv'+ i + '", violatedDirective: e.violatedDirective}, "*");',
' });',
'</scr' + 'ipt>',
'<img src="/content-security-policy/support/fail.png">'].join('\n');
var e = document.getElementById(frames[i]);
var n = e.contentWindow.document;
n.open();
n.write("<html><body>" + body_text + "</body></html>");
n.close();
}
</script>
</body>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment