haikuwebkit/LayoutTests/fast/url/segments-from-data-url2-exp...

76 lines
4.8 KiB
Plaintext
Raw Permalink Normal View History

Disallow setting base URL to a data or JavaScript URL https://bugs.webkit.org/show_bug.cgi?id=207136 Source/WebCore: Reviewed by Brent Fulgham. Inspired by <https://bugs.chromium.org/p/chromium/issues/detail?id=679318>. Block setting the base URL to a data URL or JavaScript URL as such usage is questionable. This makes WebKit match the behavior of Chrome and Firefox and is in the spirit of the discussion in <https://github.com/whatwg/html/issues/2249>. On Mac and iOS, this restriction is applied only to apps linked against a future SDK to avoid breaking shipped apps. For all other ports, this restriction is enabled by default. Tests: fast/url/relative2.html fast/url/segments-from-data-url2.html http/tests/security/allowed-base-url-data-url-via-setting.html http/tests/security/denied-base-url-data-url.html http/tests/security/denied-base-url-javascript-url.html * dom/Document.cpp: (WebCore::Document::processBaseElement): Condition updating the parsed base URL on whether is has an allowed scheme, if restrictions are enabled. Otherwise, do what we do now. If the scheme is disallowed then log a message to the console to explain this to web developers. * html/parser/HTMLPreloadScanner.cpp: (WebCore::TokenPreloadScanner::scan): Pass whether to apply restrictons to the base URL to updatePredictedBaseURL(). This depends on whether the setting is enabled or not. (WebCore::TokenPreloadScanner::updatePredictedBaseURL): Modifed to take a boolean as to whether to apply restrictions. If restrictions are not to be applied do what we do now. Otherwise, only do what we do now if the scheme for the predicated base URL is allowed. * html/parser/HTMLPreloadScanner.h: * page/SecurityPolicy.cpp: (WebCore::SecurityPolicy::isBaseURLSchemeAllowed): Added. * page/SecurityPolicy.h: * page/Settings.yaml: Add a setting to toggle restrictions on the base URL scheme. Source/WebKit: Reviewed by Brent Fulgham. Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps. * Shared/WebPreferences.yaml: * UIProcess/API/Cocoa/WKWebView.mm: (shouldRestrictBaseURLSchemes): Added. (-[WKWebView _setupPageConfiguration:]): Update settings. * UIProcess/Cocoa/VersionChecks.h: Source/WebKitLegacy/mac: Reviewed by Brent Fulgham. Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps. * Misc/WebKitVersionChecks.h: * WebView/WebView.mm: (shouldRestrictBaseURLSchemes): Added. (-[WebView _commonInitializationWithFrameName:groupName:]): Update settings. Source/WTF: Reviewed by Brent Fulgham. Add some more macro definitions. * wtf/spi/darwin/dyldSPI.h: LayoutTests: RReviewed by Brent Fulgham. Add some tests. Update others to toggle the setting to apply or unapply the new behavior. The test denied-base-url-javascript-url.html is derived from the test base-url-javascript.html, included in <https://chromium.googlesource.com/chromium/src.git/+/c133efa0b915430701930b76a7cfe35608b9a403>. * fast/url/relative-expected.txt: * fast/url/relative.html: * fast/url/relative2-expected.txt: Copied from LayoutTests/fast/url/relative-expected.txt. * fast/url/relative2.html: Copied from LayoutTests/fast/url/relative.html. * fast/url/resources/utilities.js: (setShouldEllipsizeFileURLPaths): Added. Toggles ellipsizing the path portion of a file URL to simplify matching. Otherwise, file URLs could be machine-specific. (canonicalizedPathname): Added. (segments): Modified to optionally call canonicalizedPathname. (canonicalize): Ditto. * fast/url/segments-from-data-url-expected.txt: * fast/url/segments-from-data-url.html: * fast/url/segments-from-data-url2-expected.txt: Copied from LayoutTests/fast/url/segments-from-data-url-expected.txt. * fast/url/segments-from-data-url2.html: Copied from LayoutTests/fast/url/segments-from-data-url.html. * fetch/fetch-url-serialization-expected.txt: * http/tests/plugins/navigation-during-load-embed.html: * http/tests/plugins/navigation-during-load.html: * http/tests/security/allowed-base-url-data-url-via-setting-expected.txt: Added. * http/tests/security/allowed-base-url-data-url-via-setting.html: Added. * http/tests/security/denied-base-url-data-url-expected.txt: Added. * http/tests/security/denied-base-url-data-url.html: Added. * http/tests/security/denied-base-url-javascript-url-expected.txt: Added. * http/tests/security/denied-base-url-javascript-url.html: Added. Canonical link: https://commits.webkit.org/220473@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256191 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-10 18:16:49 +00:00
Test URL segmentation
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS segments('http://user:pass@foo:21/bar;par?b#c') is '["http:","foo","21","/bar;par","?b","#c"]'
PASS segments('http:foo.com') is '["http:","foo.com","","/","",""]'
PASS segments('\t :foo.com \n') is '[":","","","","",""]'
PASS segments(' foo.com ') is '[":","","","","",""]'
PASS segments('a:\t foo.com') is '["a:","",""," foo.com","",""]'
Update URL fragment percent encode set https://bugs.webkit.org/show_bug.cgi?id=216022 Patch by Alex Christensen <achristensen@webkit.org> on 2020-09-01 Reviewed by Youenn Fablet. LayoutTests/imported/w3c: * web-platform-tests/url/a-element-expected.txt: * web-platform-tests/url/a-element-origin-expected.txt: * web-platform-tests/url/a-element-origin-xhtml-expected.txt: * web-platform-tests/url/a-element-xhtml-expected.txt: * web-platform-tests/url/failure-expected.txt: * web-platform-tests/url/resources/setters_tests.json: * web-platform-tests/url/resources/urltestdata.json: Also add some new tests from upstream. Some of them are failing now. That's fine for now. * web-platform-tests/url/url-constructor-expected.txt: * web-platform-tests/url/url-origin-expected.txt: * web-platform-tests/url/url-setters-expected.txt: Source/WTF: It now matches the behavior of Chrome and Firefox, as well as the spec at https://url.spec.whatwg.org/#fragment-percent-encode-set * wtf/URLParser.cpp: (WTF::isInFragmentEncodeSet): (WTF::URLParser::parse): Tools: * TestWebKitAPI/Tests/WTF/URLParser.cpp: (TestWebKitAPI::TEST_F): LayoutTests: * fast/dom/DOMURL/set-href-attribute-hash-expected.txt: * fast/dom/DOMURL/set-href-attribute-hash.html: * fast/dom/HTMLAnchorElement/set-href-attribute-hash-expected.txt: * fast/dom/HTMLAnchorElement/set-href-attribute-hash.html: * fast/url/anchor-expected.txt: * fast/url/anchor.html: * fast/url/segments-expected.txt: * fast/url/segments-from-data-url-expected.txt: * fast/url/segments-from-data-url.html: * fast/url/segments-from-data-url2-expected.txt: * fast/url/segments-from-data-url2.html: * fast/url/segments.html: * fast/url/standard-url-expected.txt: * fast/url/standard-url.html: * fast/url/url-tojson-expected.txt: * fast/url/url-tojson.html: * fetch/fetch-url-serialization-expected.txt: * fetch/fetch-urls.json: * http/tests/security/xssAuditor/anchor-url-dom-write-location-expected.txt: * http/tests/security/xssAuditor/anchor-url-dom-write-location2-expected.txt: * svg/dom/viewspec-parser-1-expected.txt: * svg/dom/viewspec-parser-3-expected.txt: * svg/dom/viewspec-parser-4-expected.txt: * svg/dom/viewspec-parser-5-expected.txt: * svg/dom/viewspec-parser-6-expected.txt: * svg/dom/viewspec-parser-7-expected.txt: Canonical link: https://commits.webkit.org/228832@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@266399 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-09-01 16:42:54 +00:00
PASS segments('http://f:21/ b ? d # e ') is '["http:","f","21","/%20b%20","?%20d%20","#%20e"]'
Disallow setting base URL to a data or JavaScript URL https://bugs.webkit.org/show_bug.cgi?id=207136 Source/WebCore: Reviewed by Brent Fulgham. Inspired by <https://bugs.chromium.org/p/chromium/issues/detail?id=679318>. Block setting the base URL to a data URL or JavaScript URL as such usage is questionable. This makes WebKit match the behavior of Chrome and Firefox and is in the spirit of the discussion in <https://github.com/whatwg/html/issues/2249>. On Mac and iOS, this restriction is applied only to apps linked against a future SDK to avoid breaking shipped apps. For all other ports, this restriction is enabled by default. Tests: fast/url/relative2.html fast/url/segments-from-data-url2.html http/tests/security/allowed-base-url-data-url-via-setting.html http/tests/security/denied-base-url-data-url.html http/tests/security/denied-base-url-javascript-url.html * dom/Document.cpp: (WebCore::Document::processBaseElement): Condition updating the parsed base URL on whether is has an allowed scheme, if restrictions are enabled. Otherwise, do what we do now. If the scheme is disallowed then log a message to the console to explain this to web developers. * html/parser/HTMLPreloadScanner.cpp: (WebCore::TokenPreloadScanner::scan): Pass whether to apply restrictons to the base URL to updatePredictedBaseURL(). This depends on whether the setting is enabled or not. (WebCore::TokenPreloadScanner::updatePredictedBaseURL): Modifed to take a boolean as to whether to apply restrictions. If restrictions are not to be applied do what we do now. Otherwise, only do what we do now if the scheme for the predicated base URL is allowed. * html/parser/HTMLPreloadScanner.h: * page/SecurityPolicy.cpp: (WebCore::SecurityPolicy::isBaseURLSchemeAllowed): Added. * page/SecurityPolicy.h: * page/Settings.yaml: Add a setting to toggle restrictions on the base URL scheme. Source/WebKit: Reviewed by Brent Fulgham. Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps. * Shared/WebPreferences.yaml: * UIProcess/API/Cocoa/WKWebView.mm: (shouldRestrictBaseURLSchemes): Added. (-[WKWebView _setupPageConfiguration:]): Update settings. * UIProcess/Cocoa/VersionChecks.h: Source/WebKitLegacy/mac: Reviewed by Brent Fulgham. Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps. * Misc/WebKitVersionChecks.h: * WebView/WebView.mm: (shouldRestrictBaseURLSchemes): Added. (-[WebView _commonInitializationWithFrameName:groupName:]): Update settings. Source/WTF: Reviewed by Brent Fulgham. Add some more macro definitions. * wtf/spi/darwin/dyldSPI.h: LayoutTests: RReviewed by Brent Fulgham. Add some tests. Update others to toggle the setting to apply or unapply the new behavior. The test denied-base-url-javascript-url.html is derived from the test base-url-javascript.html, included in <https://chromium.googlesource.com/chromium/src.git/+/c133efa0b915430701930b76a7cfe35608b9a403>. * fast/url/relative-expected.txt: * fast/url/relative.html: * fast/url/relative2-expected.txt: Copied from LayoutTests/fast/url/relative-expected.txt. * fast/url/relative2.html: Copied from LayoutTests/fast/url/relative.html. * fast/url/resources/utilities.js: (setShouldEllipsizeFileURLPaths): Added. Toggles ellipsizing the path portion of a file URL to simplify matching. Otherwise, file URLs could be machine-specific. (canonicalizedPathname): Added. (segments): Modified to optionally call canonicalizedPathname. (canonicalize): Ditto. * fast/url/segments-from-data-url-expected.txt: * fast/url/segments-from-data-url.html: * fast/url/segments-from-data-url2-expected.txt: Copied from LayoutTests/fast/url/segments-from-data-url-expected.txt. * fast/url/segments-from-data-url2.html: Copied from LayoutTests/fast/url/segments-from-data-url.html. * fetch/fetch-url-serialization-expected.txt: * http/tests/plugins/navigation-during-load-embed.html: * http/tests/plugins/navigation-during-load.html: * http/tests/security/allowed-base-url-data-url-via-setting-expected.txt: Added. * http/tests/security/allowed-base-url-data-url-via-setting.html: Added. * http/tests/security/denied-base-url-data-url-expected.txt: Added. * http/tests/security/denied-base-url-data-url.html: Added. * http/tests/security/denied-base-url-javascript-url-expected.txt: Added. * http/tests/security/denied-base-url-javascript-url.html: Added. Canonical link: https://commits.webkit.org/220473@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256191 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-10 18:16:49 +00:00
PASS segments('http://f:/c') is '["http:","f","","/c","",""]'
PASS segments('http://f:0/c') is '["http:","f","0","/c","",""]'
PASS segments('http://f:00000000000000/c') is '["http:","f","0","/c","",""]'
FAIL segments('http://f:00000000000000000000080/c') should be ["http:","f","0","/c","",""]. Was ["http:","f","","/c","",""].
PASS segments('http://f:b/c') is '[":","","","","",""]'
PASS segments('http://f: /c') is '[":","","","","",""]'
PASS segments('http://f:\n/c') is '["http:","f","","/c","",""]'
PASS segments('http://f:fifty-two/c') is '[":","","","","",""]'
FAIL segments('http://f:999999/c') should be [":","","0","","",""]. Was [":","","","","",""].
PASS segments('http://f: 21 / b ? d # e ') is '[":","","","","",""]'
FAIL segments('') should be ["data:","","","text/plain,baseURL","",""]. Was [":","","","","",""].
FAIL segments(' \t') should be ["data:","","","text/plain,baseURL","",""]. Was [":","","","","",""].
PASS segments(':foo.com/') is '[":","","","","",""]'
PASS segments(':foo.com\\') is '[":","","","","",""]'
PASS segments(':') is '[":","","","","",""]'
PASS segments(':a') is '[":","","","","",""]'
PASS segments(':/') is '[":","","","","",""]'
PASS segments(':\\') is '[":","","","","",""]'
PASS segments(':#') is '[":","","","","",""]'
FAIL segments('#') should be [":","","","","",""]. Was ["data:","","","text/plain,baseURL","",""].
FAIL segments('#/') should be [":","","","","",""]. Was ["data:","","","text/plain,baseURL","","#/"].
FAIL segments('#\\') should be [":","","","","",""]. Was ["data:","","","text/plain,baseURL","","#\\"].
FAIL segments('#;?') should be [":","","","","",""]. Was ["data:","","","text/plain,baseURL","","#;?"].
PASS segments('?') is '[":","","","","",""]'
PASS segments('/') is '[":","","","","",""]'
PASS segments(':23') is '[":","","","","",""]'
FAIL segments('/:23') should be ["data:","","","/:23","",""]. Was [":","","","","",""].
PASS segments('//') is '[":","","","","",""]'
PASS segments('::') is '[":","","","","",""]'
PASS segments('::23') is '[":","","","","",""]'
FAIL segments('foo://') should be ["foo:","","","//","",""]. Was ["foo:","","","","",""].
PASS segments('http://a:b@c:29/d') is '["http:","c","29","/d","",""]'
PASS segments('http::@c:29') is '["http:","c","29","/","",""]'
PASS segments('http://&a:foo(b]c@d:2/') is '["http:","d","2","/","",""]'
PASS segments('http://::@c@d:2') is '["http:","d","2","/","",""]'
PASS segments('http://foo.com:b@d/') is '["http:","d","","/","",""]'
PASS segments('http://foo.com/\\@') is '["http:","foo.com","","//@","",""]'
PASS segments('http:\\\\foo.com\\') is '["http:","foo.com","","/","",""]'
PASS segments('http:\\\\a\\b:c\\d@foo.com\\') is '["http:","a","","/b:c/d@foo.com/","",""]'
PASS segments('foo:/') is '["foo:","","","/","",""]'
PASS segments('foo:/bar.com/') is '["foo:","","","/bar.com/","",""]'
FAIL segments('foo://///////') should be ["foo:","","","/////////","",""]. Was ["foo:","","","///////","",""].
FAIL segments('foo://///////bar.com/') should be ["foo:","","","/////////bar.com/","",""]. Was ["foo:","","","///////bar.com/","",""].
FAIL segments('foo:////://///') should be ["foo:","","","////://///","",""]. Was ["foo:","","","//://///","",""].
PASS segments('c:/foo') is '["c:","","","/foo","",""]'
PASS segments('//foo/bar') is '[":","","","","",""]'
PASS segments('http://foo/path;a??e#f#g') is '["http:","foo","","/path;a","??e","#f#g"]'
PASS segments('http://foo/abcd?efgh?ijkl') is '["http:","foo","","/abcd","?efgh?ijkl",""]'
PASS segments('http://foo/abcd#foo?bar') is '["http:","foo","","/abcd","","#foo?bar"]'
FAIL segments('[61:24:74]:98') should be ["data:","","","text/[61:24:74]:98","",""]. Was [":","","","","",""].
FAIL segments('http://[61:27]:98') should be [":","","0","","",""]. Was [":","","","","",""].
PASS segments('http:[61:27]/:foo') is '[":","","","","",""]'
PASS segments('http://[1::2]:3:4') is '[":","","","","",""]'
PASS segments('http://2001::1') is '[":","","","","",""]'
PASS segments('http://[2001::1') is '[":","","","","",""]'
PASS segments('http://2001::1]') is '[":","","","","",""]'
PASS segments('http://2001::1]:80') is '[":","","","","",""]'
PASS segments('http://[2001::1]') is '["http:","[2001::1]","","/","",""]'
PASS segments('http://[2001::1]:80') is '["http:","[2001::1]","","/","",""]'
PASS segments('http://[[::]]') is '[":","","","","",""]'
PASS successfullyParsed is true
TEST COMPLETE