Attachment 762137 Details for Bug 855326

[patch] Platform 2

platform2 (text/plain), 19.59 KB, created by Garrett Robinson [:grobinson]

(hide)

Description:

Filename:

MIME Type:

Creator: Garrett Robinson [:grobinson]

Size: 19.59 KB

patch

obsolete

>From: Garrett Robinson <grobinson@mozilla.com>
>Platform 2
>
>
>diff --git a/content/base/public/nsIContentSecurityPolicy.idl b/content/base/public/nsIContentSecurityPolicy.idl
>index 1145b2d..cb56b75 100644
>--- a/content/base/public/nsIContentSecurityPolicy.idl
>+++ b/content/base/public/nsIContentSecurityPolicy.idl
>@@ -8,17 +8,17 @@ interface nsIURI;
> interface nsIHttpChannel;
> interface nsIDocShell;
> 
> /**
>  * nsIContentSecurityPolicy
>  * Describes an XPCOM component used to model an enforce CSPs.
>  */
> 
>-[scriptable, uuid(230b126d-afc3-4588-9794-3e135594d626)]
>+[scriptable, uuid(781b6511-f1fa-4e2c-8eff-1739d091eb2f)]
> interface nsIContentSecurityPolicy : nsISupports
> {
> 
>   /**
>    * Set to true when the CSP has been read in and parsed and is ready to
>    * enforce.  This is a barrier for the nsDocument so it doesn't load any
>    * sub-content until either it knows that a CSP is ready or will not be used.
>    */
>@@ -73,16 +73,22 @@ interface nsIContentSecurityPolicy : nsISupports
>    *     well.
>    * @return
>    *     Whether or not the effects of the eval call should be allowed
>    *     (block the call if false).
>    */
>   boolean getAllowsInlineStyle(out boolean shouldReportViolation);
> 
>   /**
>+   * Whether this policy recognizes a given nonce
>+   * @return Whether or not the nonce is allowed (block the call if false)
>+   */
>+   boolean getAllowsNonce(in AString nonce);
>+
>+  /**
>    * Log policy violation on the Error Console and send a report if a report-uri
>    * is present in the policy
>    *
>    * @param violationType
>    *     one of the VIOLATION_TYPE_* constants, e.g. inline-script or eval
>    * @param sourceFile
>    *     name of the source file containing the violation (if available)
>    * @param contentSample
>@@ -151,17 +157,18 @@ interface nsIContentSecurityPolicy : nsISupports
>    * Calls to this may trigger violation reports when queried, so
>    * this value should not be cached.
>    */
>   short shouldLoad(in unsigned long   aContentType, 
>                    in nsIURI          aContentLocation, 
>                    in nsIURI          aRequestOrigin, 
>                    in nsISupports     aContext, 
>                    in ACString        aMimeTypeGuess, 
>-                   in nsISupports     aExtra);
>+                   in nsISupports     aExtra,
>+                   in AString         aNonce);
> 
>   /**
>    * Delegate method called by the service when sub-elements of the protected
>    * document are being processed.  Given a bit of information about the request,
>    * decides whether or not the policy is satisfied.
>    */
>   short shouldProcess(in unsigned long   aContentType, 
>                       in nsIURI          aContentLocation, 
>diff --git a/content/base/src/CSPUtils.jsm b/content/base/src/CSPUtils.jsm
>index 025aedf..48d0697 100644
>--- a/content/base/src/CSPUtils.jsm
>+++ b/content/base/src/CSPUtils.jsm
>@@ -57,20 +57,25 @@ const R_HOSTSRC    = new RegExp ("^((" + R_SCHEME.source + "\\:\\/\\/)?("
> 
> // ext-host-source = host-source "/" *( <VCHAR except ";" and ","> )
> //                 ; ext-host-source is reserved for future use.
> const R_EXTHOSTSRC = new RegExp ("^" + R_HOSTSRC.source + "\\/[:print:]+$", 'i');
> 
> // keyword-source  = "'self'" / "'unsafe-inline'" / "'unsafe-eval'"
> const R_KEYWORDSRC = new RegExp ("^('self'|'unsafe-inline'|'unsafe-eval')$", 'i');
> 
>+// nonce-source      = "'nonce-" nonce-value "'"
>+// nonce-value       = *( ALPHA / DIGIT )
>+const R_NONCESRC = new RegExp ("^'nonce-([a-zA-Z0-9]+)'$", 'i');
>+
> // source-exp      = scheme-source / host-source / keyword-source
> const R_SOURCEEXP  = new RegExp (R_SCHEMESRC.source + "|" +
>                                    R_HOSTSRC.source + "|" +
>-                                R_KEYWORDSRC.source,  'i');
>+                                R_KEYWORDSRC.source + "|" +
>+                                  R_NONCESRC.source,  'i');
> 
> 
> var gPrefObserver = {
>   get debugEnabled () {
>     if (!this._branch)
>       this._initialize();
>     return this._debugEnabled;
>   },
>@@ -177,16 +182,19 @@ this.CSPRep = function CSPRep(aSpecCompliant) {
> 
>   // don't auto-populate _directives, so it is easier to find bugs
>   this._directives = {};
> 
>   // Is this a 1.0 spec compliant CSPRep ?
>   // Default to false if not specified.
>   this._specCompliant = (aSpecCompliant !== undefined) ? aSpecCompliant : false;
> 
>+  // Does this CSP contain directives from the experimental CSP 1.1 spec?
>+  this._isExperimental = false;
>+
>   // Only CSP 1.0 spec compliant policies block inline styles by default.
>   this._allowInlineStyles = !aSpecCompliant;
> }
> 
> // Source directives for our original CSP implementation.
> // These can be removed when the original implementation is deprecated.
> CSPRep.SRC_DIRECTIVES_OLD = {
>   DEFAULT_SRC:      "default-src",
>@@ -575,29 +583,29 @@ CSPRep.fromStringSpecCompliant = function(aStr, self, docRequest, csp) {
>           uri.host;
> 
>           // Verify that each report URI is in the same etld + 1 and that the
>           // scheme and port match "self" if "self" is defined, and just that
>           // it's valid otherwise.
>           if (self) {
>             if (gETLDService.getBaseDomain(uri) !==
>                 gETLDService.getBaseDomain(selfUri)) {
>-              cspWarn(aCSPR, 
>+              cspWarn(aCSPR,
>                       CSPLocalizer.getFormatStr("notETLDPlus1",
>                                             [gETLDService.getBaseDomain(uri)]));
>               continue;
>             }
>             if (!uri.schemeIs(selfUri.scheme)) {
>-              cspWarn(aCSPR, 
>+              cspWarn(aCSPR,
>                       CSPLocalizer.getFormatStr("notSameScheme",
>                                                 [uri.asciiSpec]));
>               continue;
>             }
>             if (uri.port && uri.port !== selfUri.port) {
>-              cspWarn(aCSPR, 
>+              cspWarn(aCSPR,
>                       CSPLocalizer.getFormatStr("notSamePort",
>                                                 [uri.asciiSpec]));
>               continue;
>             }
>           }
>         } catch(e) {
>           switch (e.result) {
>             case Components.results.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS:
>@@ -605,17 +613,17 @@ CSPRep.fromStringSpecCompliant = function(aStr, self, docRequest, csp) {
>               if (uri.host !== selfUri.host) {
>                 cspWarn(aCSPR, CSPLocalizer.getFormatStr("pageCannotSendReportsTo",
>                                                          [selfUri.host, uri.host]));
>                 continue;
>               }
>               break;
> 
>             default:
>-              cspWarn(aCSPR, CSPLocalizer.getFormatStr("couldNotParseReportURI", 
>+              cspWarn(aCSPR, CSPLocalizer.getFormatStr("couldNotParseReportURI",
>                                                        [uriStrings[i]]));
>               continue;
>           }
>         }
>         // all verification passed: same ETLD+1, scheme, and port.
>        okUriStrings.push(uri.asciiSpec);
>       }
>       aCSPR._directives[UD.REPORT_URI] = okUriStrings.join(' ');
>@@ -956,16 +964,17 @@ CSPRep.prototype = {
> };
> 
> //////////////////////////////////////////////////////////////////////
> /**
>  * Class to represent a list of sources
>  */
> this.CSPSourceList = function CSPSourceList() {
>   this._sources = [];
>+  this._nonces = []; // TODO: might be more efficient than storing nonces individually on the sources
>   this._permitAllSources = false;
> 
>   // Set to true when this list is created using "makeExplicit()"
>   // It's useful to know this when reporting the directive that was violated.
>   this._isImplicit = false;
> 
>   // When this is true, the source list contains 'unsafe-inline'.
>   this._allowUnsafeInline = false;
>@@ -1209,16 +1218,17 @@ CSPSourceList.prototype = {
> //////////////////////////////////////////////////////////////////////
> /**
>  * Class to model a source (scheme, host, port)
>  */
> this.CSPSource = function CSPSource() {
>   this._scheme = undefined;
>   this._port = undefined;
>   this._host = undefined;
>+  this._nonce = undefined;
> 
>   //when set to true, this allows all source
>   this._permitAll = false;
> 
>   // when set to true, this source represents 'self'
>   this._isSelf = false;
> 
>   // when set to true, this source allows inline scripts or styles
>@@ -1453,16 +1463,23 @@ CSPSource.fromString = function(aStr, aCSPRep, self, enforceSelfChecks) {
>     }
>     else {
>       // strip the ':' from the port
>       sObj._port = portMatch[0].substr(1);
>     }
>     return sObj;
>   }
> 
>+  // check for a nonce-source match
>+  if (R_NONCESRC.test(aStr)) {
>+    var nonceSrcMatch = R_NONCESRC.exec(aStr);
>+    sObj._nonce = nonceSrcMatch[1];
>+    return sObj;
>+  }
>+
>   // check for 'self' (case insensitive)
>   if (aStr.toUpperCase() === "'SELF'") {
>     if (!self) {
>       cspError(aCSPRep, CSPLocalizer.getStr("selfKeywordNoSelfData"));
>       return null;
>     }
>     sObj._self = self.clone();
>     sObj._isSelf = true;
>@@ -1557,31 +1574,34 @@ CSPSource.prototype = {
> 
>     var s = "";
>     if (this.scheme)
>       s = s + this.scheme + "://";
>     if (this._host)
>       s = s + this._host;
>     if (this.port)
>       s = s + ":" + this.port;
>+    if (this._nonce)
>+      s = s + " nonce-" + this._nonce;
>     return s;
>   },
> 
>   /**
>    * Makes a new deep copy of this object.
>    * @returns
>    *      a new CSPSource
>    */
>   clone:
>   function() {
>     var aClone = new CSPSource();
>     aClone._self = this._self ? this._self.clone() : undefined;
>     aClone._scheme = this._scheme;
>     aClone._port = this._port;
>     aClone._host = this._host ? this._host.clone() : undefined;
>+    aClone._nonce = this._nonce;
>     aClone._isSelf = this._isSelf;
>     aClone._CSPRep = this._CSPRep;
>     return aClone;
>   },
> 
>   /**
>    * Determines if this Source accepts a URI.
>    * @param aSource
>diff --git a/content/base/src/contentSecurityPolicy.js b/content/base/src/contentSecurityPolicy.js
>index f305474..52439e5 100644
>--- a/content/base/src/contentSecurityPolicy.js
>+++ b/content/base/src/contentSecurityPolicy.js
>@@ -148,16 +148,29 @@ ContentSecurityPolicy.prototype = {
>   getAllowsInlineStyle: function(shouldReportViolation) {
>     // report it?
>     shouldReportViolation.value = !this._policy.allowsInlineStyles;
> 
>     // allow it to execute?
>     return this._reportOnlyMode || this._policy.allowsInlineStyles;
>   },
> 
>+  getAllowsNonce: function(nonce) {
>+    // TODO: shouldReportViolation?
>+    script_srcs = this._policy._directives[CSPRep.SRC_DIRECTIVES_NEW["SCRIPT_SRC"]]._sources;
>+    for (let i in script_srcs) {
>+      let script_src = script_srcs[i];
>+      // DEBUG
>+      CSPdebug("nonce: " + script_src._nonce);
>+      if (script_src._nonce == nonce)
>+        return true;
>+    }
>+    return false;
>+  },
>+
>   /**
>    * Log policy violation on the Error Console and send a report if a report-uri
>    * is present in the policy
>    *
>    * @param aViolationType
>    *     one of the VIOLATION_TYPE_* constants, e.g. inline-script or eval
>    * @param aSourceFile
>    *     name of the source file containing the violation (if available)
>@@ -498,17 +511,27 @@ ContentSecurityPolicy.prototype = {
>    * decides whether or not the policy is satisfied.
>    */
>   shouldLoad:
>   function csp_shouldLoad(aContentType,
>                           aContentLocation,
>                           aRequestOrigin,
>                           aContext,
>                           aMimeTypeGuess,
>-                          aOriginalUri) {
>+                          aOriginalUri,
>+                          aNonce) {
>+    // HACK: skip policy check on script preload so we can have nonces on
>+    // external scripts. See Bug 612921
>+    if (aContentType == Ci.nsIContentPolicy.TYPE_SCRIPT &&
>+        aContext instanceof Ci.nsIDOMHTMLDocument) {
>+      // TODO: Is this always the right thing to do?
>+      // Note - always returning ACCEPT raises an assertion
>+      return Ci.nsIContentPolicy.REJECT_SERVER;
>+    }
>+
>     let key = aContentLocation.spec + "!" + aContentType;
>     if (this._cache[key]) {
>       return this._cache[key];
>     }
> 
> #ifndef MOZ_B2G
>     // Try to remove as much as possible from the hot path on b2g.
>     CSPdebug("shouldLoad location = " + aContentLocation.asciiSpec);
>@@ -531,26 +554,30 @@ ContentSecurityPolicy.prototype = {
>     if (aContentType == cp.TYPE_XMLHTTPREQUEST && this._policy._specCompliant) {
>       cspContext = ContentSecurityPolicy._MAPPINGS[CSP_TYPE_XMLHTTPREQUEST_SPEC_COMPLIANT];
>     } else if (aContentType == cp.TYPE_WEBSOCKET && this._policy._specCompliant) {
>       cspContext = ContentSecurityPolicy._MAPPINGS[CSP_TYPE_WEBSOCKET_SPEC_COMPLIANT];
>     } else {
>       cspContext = ContentSecurityPolicy._MAPPINGS[aContentType];
>     }
> 
>-    CSPdebug("shouldLoad cspContext = " + cspContext);
>+    // if the content type is script (TODO: or style), see if there's a nonce
>+    var hasValidNonce = false;
>+    if (aNonce && aContentType == cp.TYPE_SCRIPT) {
>+      hasValidNonce = this.getAllowsNonce(aNonce);
>+    }
> 
>     // if the mapping is null, there's no policy, let it through.
>     if (!cspContext) {
>       return Ci.nsIContentPolicy.ACCEPT;
>     }
> 
>     // otherwise, honor the translation
>     // var source = aContentLocation.scheme + "://" + aContentLocation.hostPort;
>-    var res = this._policy.permits(aContentLocation, cspContext)
>+    var res = (this._policy.permits(aContentLocation, cspContext) || hasValidNonce)
>               ? Ci.nsIContentPolicy.ACCEPT
>               : Ci.nsIContentPolicy.REJECT_SERVER;
> 
>     // frame-ancestors is taken care of early on (as this document is loaded)
> 
>     // If the result is *NOT* ACCEPT, then send report
>     if (res != Ci.nsIContentPolicy.ACCEPT) {
>       CSPdebug("blocking request for " + aContentLocation.asciiSpec);
>diff --git a/content/base/src/nsCSPService.cpp b/content/base/src/nsCSPService.cpp
>index 42e8b99..7493aaa 100644
>--- a/content/base/src/nsCSPService.cpp
>+++ b/content/base/src/nsCSPService.cpp
>@@ -18,16 +18,18 @@
> #include "nsIWritablePropertyBag2.h"
> #include "nsError.h"
> #include "nsChannelProperties.h"
> #include "nsIAsyncVerifyRedirectCallback.h"
> #include "nsAsyncRedirectVerifyHelper.h"
> #include "mozilla/Preferences.h"
> #include "nsIScriptError.h"
> #include "nsContentUtils.h"
>+#include "nsIScriptElement.h"
>+#include "nsIDocument.h"
> 
> using namespace mozilla;
> 
> /* Keeps track of whether or not CSP is enabled */
> bool CSPService::sCSPEnabled = true;
> 
> #ifdef PR_LOGGING
> static PRLogModuleInfo* gCspPRLog;
>@@ -116,24 +118,36 @@ CSPService::ShouldLoad(uint32_t aContentType,
>         if (csp) {
> #ifdef PR_LOGGING
>             nsAutoString policy;
>             csp->GetPolicy(policy);
>             PR_LOG(gCspPRLog, PR_LOG_DEBUG,
>                     ("Document has CSP: %s",
>                      NS_ConvertUTF16toUTF8(policy).get()));
> #endif
>+
>+            // If this is a script (TODO: or style), extract the nonce attribute
>+            nsAutoString nonce;
>+            if (aContentType == nsIContentPolicy::TYPE_SCRIPT) {
>+              nsCOMPtr<nsIScriptElement> contextScriptElement = do_QueryInterface(aRequestContext);
>+              if (contextScriptElement) {
>+                nsCOMPtr<nsIContent> scriptContent = do_QueryInterface(contextScriptElement);
>+                scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
>+              }
>+            }
>+
>             // obtain the enforcement decision
>             // (don't pass aExtra, we use that slot for redirects)
>             csp->ShouldLoad(aContentType,
>                             aContentLocation,
>                             aRequestOrigin,
>                             aRequestContext,
>                             aMimeTypeGuess,
>                             nullptr,
>+                            nonce,
>                             aDecision);
>         }
>     }
> #ifdef PR_LOGGING
>     else {
>         nsAutoCString uriSpec;
>         aContentLocation->GetSpec(uriSpec);
>         PR_LOG(gCspPRLog, PR_LOG_DEBUG,
>@@ -251,16 +265,17 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel,
>   oldChannel->GetOriginalURI(getter_AddRefs(originalUri));
>   int16_t aDecision = nsIContentPolicy::ACCEPT;
>   csp->ShouldLoad(loadType,        // load type per nsIContentPolicy (uint32_t)
>                   newUri,          // nsIURI
>                   nullptr,          // nsIURI
>                   nullptr,          // nsISupports
>                   EmptyCString(),  // ACString - MIME guess
>                   originalUri,     // nsISupports - extra
>+                  EmptyString(), // TODO: what to do with the nonce?
>                   &aDecision);
> 
> #ifdef PR_LOGGING
>   if (newUri) {
>     nsAutoCString newUriSpec("None");
>     newUri->GetSpec(newUriSpec);
>     PR_LOG(gCspPRLog, PR_LOG_DEBUG,
>            ("CSPService::AsyncOnChannelRedirect called for %s",
>diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
>index f10db5e..c85d0b3 100644
>--- a/content/base/src/nsGkAtomList.h
>+++ b/content/base/src/nsGkAtomList.h
>@@ -607,16 +607,17 @@ GK_ATOM(no, "no")
> GK_ATOM(noautohide, "noautohide")
> GK_ATOM(nobr, "nobr")
> GK_ATOM(node, "node")
> GK_ATOM(nodefaultsrc, "nodefaultsrc")
> GK_ATOM(nodeSet, "node-set")
> GK_ATOM(noembed, "noembed")
> GK_ATOM(noframes, "noframes")
> GK_ATOM(nohref, "nohref")
>+GK_ATOM(nonce, "nonce")
> GK_ATOM(none, "none")
> GK_ATOM(noresize, "noresize")
> GK_ATOM(normal, "normal")
> GK_ATOM(normalizeSpace, "normalize-space")
> GK_ATOM(noscript, "noscript")
> GK_ATOM(noshade, "noshade")
> GK_ATOM(novalidate, "novalidate")
> GK_ATOM(_not, "not")
>diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
>index 040650b..d65ece5 100644
>--- a/content/base/src/nsScriptLoader.cpp
>+++ b/content/base/src/nsScriptLoader.cpp
>@@ -608,23 +608,37 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
>     return false;
>   }
> 
>   nsCOMPtr<nsIContentSecurityPolicy> csp;
>   rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
>   NS_ENSURE_SUCCESS(rv, false);
> 
>   if (csp) {
>-    PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader i ****with CSP****"));
>+    PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader ****with CSP****"));
>     bool inlineOK = true;
>     bool reportViolations = false;
>     rv = csp->GetAllowsInlineScript(&reportViolations, &inlineOK);
>     NS_ENSURE_SUCCESS(rv, false);
> 
>-    if (reportViolations) {
>+    bool nonceOK = false;
>+    // If unsafe-inline is set, skip the nonce check (we'll run the inline
>+    // script regardless)
>+    if (!inlineOK) {
>+      nsAutoString nonce;
>+      scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
>+      if (!nonce.IsEmpty()) {
>+        rv = csp->GetAllowsNonce(nonce, &nonceOK);
>+        NS_ENSURE_SUCCESS(rv, false);
>+      }
>+    }
>+
>+    bool scriptElementOK = inlineOK || nonceOK;
>+
>+    if (!scriptElementOK && reportViolations) {
>       // gather information to log with violation report
>       nsIURI* uri = mDocument->GetDocumentURI();
>       nsAutoCString asciiSpec;
>       uri->GetAsciiSpec(asciiSpec);
>       nsAutoString scriptText;
>       aElement->GetScriptText(scriptText);
> 
>       // cap the length of the script sample at 40 chars
>@@ -634,18 +648,18 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
>       }
> 
>       csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT,
>                                NS_ConvertUTF8toUTF16(asciiSpec),
>                                scriptText,
>                                aElement->GetScriptLineNumber());
>     }
> 
>-    if (!inlineOK) {
>-      PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("CSP blocked inline scripts (2)"));
>+    if (!scriptElementOK) {
>+      PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("CSP blocked inline scripts"));
>       return false;
>     }
>   }
> 
>   // Inline scripts ignore ther CORS mode and are always CORS_NONE
>   request = new nsScriptLoadRequest(aElement, version, CORS_NONE);
>   request->mJSVersion = version;
>   request->mLoading = false;

Actions: View | Diff | Review

Attachments on bug 855326: 755713 | 755714 | 758607 | 762133 | 762137 | 762416 | 765096 | 765098 | 766968 | 767335 | 769500 | 778749 | 780603 | 786684 | 823662 | 827126 | 827674 | 828383 | 828821 | 829016 | 829377 | 829555 | 829616