Skip to content

Commit 74af2dd

Browse files
juliandescottesjuliandescottes
committed
Add WebDriver BiDi CSP bypass checks at enforcement points
Adds BiDi bypass checks at various CSP enforcement points. Ensures CSP is bypassed even if policies are added after the initialization of the document or if the bypass was not set when the document was initialized..
1 parent 90d0458 commit 74af2dd

1 file changed

Lines changed: 61 additions & 23 deletions

File tree

‎index.bs‎

Lines changed: 61 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1016,6 +1016,22 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10161016
Note: This integration point allows WebDriver BiDi to disable CSP enforcement
10171017
during automated testing, similar to Chrome DevTools Protocol's Page.setBypassCSP.
10181018

1019+
<h4 id="obtain-navigable-for-request" algorithm dfn>
1020+
Obtain the navigable for a request
1021+
</h4>
1022+
1023+
Given a <a for="/">request</a> |request|, this algorithm returns a <a>navigable</a> or null.
1024+
1025+
1. Let |navigable| be null.
1026+
1027+
2. If |request|'s [=request/client=] is an [=environment settings object=]:
1028+
1029+
1. Let |environment settings| be |request|'s [=request/client=].
1030+
1031+
2. If there is a [=navigable=] whose [=navigable/active window=] is |environment settings|' [=environment settings object/global object=], set |navigable| to be that [=navigable=].
1032+
1033+
3. Return |navigable|.
1034+
10191035
<h3 id="fetch-integration">
10201036
Integration with Fetch
10211037
</h3>
@@ -1066,11 +1082,15 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10661082
reports violations based on |request|'s [=request/policy container=]'s
10671083
[=policy container/CSP list=].
10681084

1069-
1. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
1085+
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
1086+
1087+
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
10701088

1071-
2. Let |result| be "`Allowed`".
1089+
3. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
10721090

1073-
3. <a for=list>For each</a> |policy| of |CSP list|:
1091+
4. Let |result| be "`Allowed`".
1092+
1093+
5. <a for=list>For each</a> |policy| of |CSP list|:
10741094

10751095
1. If |policy|'s <a for="policy">disposition</a> is "`report`",
10761096
then skip to the next |policy|.
@@ -1085,7 +1105,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10851105

10861106
2. Set |result| to "`Blocked`".
10871107

1088-
4. Return |result|.
1108+
6. Return |result|.
10891109

10901110
<h4 id="should-block-response" algorithm dfn export>
10911111
Should |response| to |request| be blocked by Content Security Policy?
@@ -1095,11 +1115,15 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10951115
returns `Blocked` or `Allowed`, and reports violations based on |request|'s
10961116
[=request/policy container=]'s [=policy container/CSP list=].
10971117

1098-
1. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
1118+
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
1119+
1120+
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
10991121

1100-
2. Let |result| be "`Allowed`".
1122+
3. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
11011123

1102-
3. <a for=list>For each</a> |policy| of |CSP list|:
1124+
4. Let |result| be "`Allowed`".
1125+
1126+
5. <a for=list>For each</a> |policy| of |CSP list|:
11031127

11041128
1. <a for=set>For each</a> |directive| of |policy|:
11051129

@@ -1116,7 +1140,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
11161140
response. That is, that a Service Worker hasn't substituted a file which
11171141
would violate the page's CSP.
11181142

1119-
4. Return |result|.
1143+
6. Return |result|.
11201144

11211145
<h4 id="potentially-report-hash" algorithm dfn export>Potentially report hash</h4>
11221146

@@ -1261,9 +1285,13 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
12611285
<ol class="algorithm">
12621286
1. Assert: |element| is not null.
12631287

1264-
2. Let |result| be "`Allowed`".
1288+
2. Let |navigable| be |element|'s [=/node navigable=].
1289+
1290+
3. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
12651291

1266-
3. <a for=list>For each</a> |policy| of |element|'s {{Document}}'s <a for="/">global object</a>'s
1292+
4. Let |result| be "`Allowed`".
1293+
1294+
5. <a for=list>For each</a> |policy| of |element|'s {{Document}}'s <a for="/">global object</a>'s
12671295
<a for="global object">CSP list</a>:
12681296

12691297
1. <a for=set>For each</a> |directive| of |policy|'s <a for="policy">directive set</a>:
@@ -1294,7 +1322,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
12941322
8. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
12951323
set |result| to "`Blocked`".
12961324

1297-
4. Return |result|.
1325+
6. Return |result|.
12981326
</ol>
12991327

13001328
<h4 id="should-block-navigation-request" algorithm dfn export>
@@ -1307,9 +1335,13 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13071335
the navigation, and "`Allowed`" otherwise:
13081336

13091337
<ol class="algorithm">
1310-
1. Let |result| be "`Allowed`".
1338+
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |navigation request|.
1339+
1340+
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
13111341

1312-
2. <a for=list>For each</a> |policy| of |navigation request|'s <a for="request">policy container</a>'s
1342+
3. Let |result| be "`Allowed`".
1343+
1344+
4. <a for=list>For each</a> |policy| of |navigation request|'s <a for="request">policy container</a>'s
13131345
<a for="policy container">CSP list</a>:
13141346

13151347
1. <a for=set>For each</a> |directive| of |policy|:
@@ -1331,7 +1363,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13311363
5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
13321364
set |result| to "`Blocked`".
13331365

1334-
3. If |result| is "`Allowed`", and if |navigation request|'s
1366+
5. If |result| is "`Allowed`", and if |navigation request|'s
13351367
<a for="request">current URL</a>'s <a for="url">scheme</a> is `javascript`:
13361368

13371369
1. <a for=list>For each</a> |policy| of |navigation request|'s
@@ -1360,7 +1392,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13601392
6. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
13611393
set |result| to "`Blocked`".
13621394

1363-
4. Return |result|.
1395+
6. Return |result|.
13641396
</ol>
13651397

13661398
<h4 id="should-block-navigation-response" algorithm dfn export>
@@ -1375,9 +1407,11 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13751407
otherwise:
13761408

13771409
<ol class="algorithm">
1378-
1. Let |result| be "`Allowed`".
1410+
1. If |target| is a [=navigable=] and [=WebDriver BiDi CSP bypass is enabled=] given |target| is true, return "`Allowed`".
1411+
1412+
2. Let |result| be "`Allowed`".
13791413

1380-
2. <a for=list>For each</a> |policy| of |response CSP list|:
1414+
3. <a for=list>For each</a> |policy| of |response CSP list|:
13811415

13821416
Note: Some directives (like <a>frame-ancestors</a>) allow a |response|'s
13831417
<a>Content Security Policy</a> to act on the navigation.
@@ -1404,7 +1438,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
14041438
5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
14051439
set |result| to "`Blocked`".
14061440

1407-
3. <a for=list>For each</a> |policy| of |navigation request|'s <a for="request">policy container</a>'s
1441+
4. <a for=list>For each</a> |policy| of |navigation request|'s <a for="request">policy container</a>'s
14081442
<a for="policy container">CSP list</a>:
14091443

14101444
Note: Some directives in the |navigation request|'s context (like <a>frame-ancestors</a>)
@@ -1430,7 +1464,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
14301464
5. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
14311465
set |result| to "`Blocked`".
14321466

1433-
4. Return |result|.
1467+
5. Return |result|.
14341468
</ol>
14351469

14361470
<h4 id="run-global-object-csp-initialization" algorithm dfn export>
@@ -3866,19 +3900,23 @@ Content-Type: application/reports+json
38663900
algorithm returns the violated <a>directive</a> if the request violates the
38673901
policy, and "`Does Not Violate`" otherwise.
38683902

3869-
1. If |request|'s [=request/initiator=] is "`prefetch`", then return the result of executing
3903+
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
3904+
3905+
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Does Not Violate`".
3906+
3907+
3. If |request|'s [=request/initiator=] is "`prefetch`", then return the result of executing
38703908
[[#does-resource-hint-violate-policy]] on |request| and |policy|.
38713909

3872-
2. Let |violates| be "`Does Not Violate`".
3910+
4. Let |violates| be "`Does Not Violate`".
38733911

3874-
3. <a for=set>For each</a> |directive| of |policy|:
3912+
5. <a for=set>For each</a> |directive| of |policy|:
38753913

38763914
1. Let |result| be the result of executing |directive|'s
38773915
<a for="directive">pre-request check</a> on |request| and |policy|.
38783916

38793917
2. If |result| is "`Blocked`", then let |violates| be |directive|.
38803918

3881-
4. Return |violates|.
3919+
6. Return |violates|.
38823920

38833921
<h5 id="does-resource-hint-violate-policy">
38843922
Does resource hint |request| violate |policy|?

0 commit comments

Comments
 (0)