Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: 7-3-x
Branches Tags
electron
/
patches
/
chromium
/
backport_1074317.patch

backport_1074317.patch 4.5 KB
Permalink History Raw

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Cheng Zhao <[email protected]>
    3. 

  3. Date: Thu, 4 Oct 2018 14:57:02 -0700
    4. 

  4. Subject: fix: stop leaking cross-origin post-redirect data using StackTrace
    5. 

  5. 

  6. [1074317] [High] [CVE-2020-6511]: Security: The CSP reports and stacktraces of errors leaks post-redirect URL for <script>
    7. 

  7. Backport https://chromium.googlesource.com/chromium/src/+/0b707cbaa2cb806162797be55caf9f8074fbdccf
    8. 

  8. 

  9. diff --git a/third_party/blink/renderer/bindings/core/v8/script_source_code.cc b/third_party/blink/renderer/bindings/core/v8/script_source_code.cc
    10. 

  10. index 2993ffb7c084406ed731744e6c854d0ece5d207b..4bc73561d781713355bd94631914a1f2305e0c2f 100644
    11. 

  11. --- a/third_party/blink/renderer/bindings/core/v8/script_source_code.cc
    12. 

  12. +++ b/third_party/blink/renderer/bindings/core/v8/script_source_code.cc
    13. 

  13. @@ -4,6 +4,7 @@
    14. 

  14.  
    15. 

  15.  #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
    16. 

  16.  
    17. 

  17. +#include "base/feature_list.h"
    18. 

  18.  #include "third_party/blink/renderer/core/loader/resource/script_resource.h"
    19. 

  19.  
    20. 

  20.  namespace blink {
    21. 

  21. @@ -46,8 +47,16 @@ String SourceMapUrlFromResponse(const ResourceResponse& response) {
    22. 

  22.    return response.HttpHeaderField(http_names::kXSourceMap);
    23. 

  23.  }
    24. 

  24.  
    25. 

  25. +const base::Feature kUnsafeScriptReportPostRedirectURL{
    26. 

  26. +    "UnsafeScriptReportPostRedirectURL", base::FEATURE_DISABLED_BY_DEFAULT};
    27. 

  27. +
    28. 

  28.  }  // namespace
    29. 

  29.  
    30. 

  30. +// static
    31. 

  31. +bool ScriptSourceCode::UsePostRedirectURL() {
    32. 

  32. +  return base::FeatureList::IsEnabled(kUnsafeScriptReportPostRedirectURL);
    33. 

  33. +}
    34. 

  34. +
    35. 

  35.  ScriptSourceCode::ScriptSourceCode(
    36. 

  36.      const ParkableString& source,
    37. 

  37.      ScriptSourceLocationType source_location_type,
    38. 

  38. @@ -83,8 +92,9 @@ ScriptSourceCode::ScriptSourceCode(ScriptStreamer* streamer,
    39. 

  39.        cache_handler_(resource->CacheHandler()),
    40. 

  40.        streamer_(streamer),
    41. 

  41.        not_streaming_reason_(reason),
    42. 

  42. -      url_(
    43. 

  43. -          StripFragmentIdentifier(resource->GetResponse().CurrentRequestUrl())),
    44. 

  44. +      url_(StripFragmentIdentifier(
    45. 

  45. +          UsePostRedirectURL() ? resource->GetResponse().CurrentRequestUrl()
    46. 

  46. +                               : resource->Url())),
    47. 

  47.        source_map_url_(SourceMapUrlFromResponse(resource->GetResponse())),
    48. 

  48.        start_position_(TextPosition::MinimumPosition()),
    49. 

  49.        source_location_type_(ScriptSourceLocationType::kExternalFile) {
    50. 

  50. diff --git a/third_party/blink/renderer/bindings/core/v8/script_source_code.h b/third_party/blink/renderer/bindings/core/v8/script_source_code.h
    51. 

  51. index 8fe2bd4e487ff6a67cbe6a3cfb9e00bd5a85da32..41023cec3603a67dba15b71c4b2e3ba12f222f8a 100644
    52. 

  52. --- a/third_party/blink/renderer/bindings/core/v8/script_source_code.h
    53. 

  53. +++ b/third_party/blink/renderer/bindings/core/v8/script_source_code.h
    54. 

  54. @@ -49,6 +49,20 @@ class CORE_EXPORT ScriptSourceCode final {
    55. 

  55.    DISALLOW_NEW();
    56. 

  56.  
    57. 

  57.   public:
    58. 

  58. +  // Return whether chrome should use the request URL or the response URL as the
    59. 

  59. +  // 'url' of the script. This can be observed in:
    60. 

  60. +  // 1) The 'source-file' in CSP violations reports.
    61. 

  61. +  // 2) The URL(s) in javascript stack traces.
    62. 

  62. +  // 3) How relative source map are resolved.
    63. 

  63. +  //
    64. 

  64. +  // This returns false by default. This corresponds to the current
    65. 

  65. +  // specification and matches Firefox behavior. This also avoids leaking
    66. 

  66. +  // post-redirect data cross-origin. See https://crbug.com/1074317.
    67. 

  67. +  //
    68. 

  68. +  // This can be enabled using the switch:
    69. 

  69. +  // --enable-features=UnsafeScriptReportPostRedirectURL
    70. 

  70. +  static bool UsePostRedirectURL();
    71. 

  71. +
    72. 

  72.    // For inline scripts.
    73. 

  73.    ScriptSourceCode(
    74. 

  74.        const String& source,
    75. 

  75. diff --git a/third_party/blink/renderer/core/workers/worker_global_scope.cc b/third_party/blink/renderer/core/workers/worker_global_scope.cc
    76. 

  76. index 10f2de79d8eab681607f3b748cdf823386351cf2..12d6d90ea2ea6178fc9e83df5430fe5df80d4d73 100644
    77. 

  77. --- a/third_party/blink/renderer/core/workers/worker_global_scope.cc
    78. 

  78. +++ b/third_party/blink/renderer/core/workers/worker_global_scope.cc
    79. 

  79. @@ -265,7 +265,9 @@ void WorkerGlobalScope::ImportScriptsInternal(const Vector<String>& urls,
    80. 

  80.          source_code.length(), handler ? handler->GetCodeCacheSize() : 0);
    81. 

  81.      ScriptController()->Evaluate(
    82. 

  82.          ScriptSourceCode(source_code, ScriptSourceLocationType::kUnknown,
    83. 

  83. -                         handler, response_url),
    84. 

  84. +                         handler,
    85. 

  85. +                         ScriptSourceCode::UsePostRedirectURL() ? response_url
    86. 

  86. +                                                                : complete_url),
    87. 

  87.          sanitize_script_errors, &error_event, GetV8CacheOptions());
    88. 

  88.      if (error_event) {
    89. 

  89.        ScriptController()->RethrowExceptionFromImportedScript(error_event,
    90.