Skip to content

Replaced 'alias' with 'copy' for less ambiguity #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 1, 2017
Merged

Replaced 'alias' with 'copy' for less ambiguity #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c7e86f4
Merge pull request #1 from w3c/master
andypaicu Oct 13, 2017
e7f628a
Merge remote-tracking branch 'upstream/master' into HEAD
andypaicu Nov 22, 2017
252a9b2
Merge remote-tracking branch 'upstream/master' into HEAD
andypaicu Nov 27, 2017
24c27c9
Merge remote-tracking branch 'upstream/master' into HEAD
andypaicu Dec 1, 2017
d5a5f52
Replaced 'alias' with 'copy' for less ambiguity
andypaicu Nov 28, 2017
af9ec8f
Added a new security consderation section that discusses inheriting CSP
andypaicu Nov 29, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 38 additions & 8 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1176,9 +1176,9 @@
}
}
</style>
<meta content="Bikeshed version fbf1456a756299b3ff6d248d0857ec87f2e68cd7" name="generator">
<meta content="Bikeshed version 598edd67958c4af02f5d5c1b80d0267afc6cccf8" name="generator">
<link href="https://www.w3.org/TR/CSP3/" rel="canonical">
<meta content="cbf0037817daf1bb1a0ce4abb5fd567bd1423173" name="document-revision">
<meta content="d5a5f52f312e59e16392e7fa7bcd42d06de77572" name="document-revision">
<style>
ul.toc ul ul ul {
margin: 0 0 0 2em;
Expand Down Expand Up @@ -1458,7 +1458,7 @@
<div class="head">
<p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2016/logos/W3C" width="72"> </a> </p>
<h1>Content Security Policy Level 3</h1>
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2017-11-29">29 November 2017</time></span></h2>
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2017-12-01">1 December 2017</time></span></h2>
<div data-fill-with="spec-metadata">
<dl>
<dt>This version:
Expand Down Expand Up @@ -1770,6 +1770,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
<li><a href="#security-violation-reports"><span class="secno">7.5</span> <span class="content">Violation Reports</span></a>
<li><a href="#source-list-paths-and-redirects"><span class="secno">7.6</span> <span class="content">Paths and Redirects</span></a>
<li><a href="#security-secure-upgrades"><span class="secno">7.7</span> <span class="content">Secure Upgrades</span></a>
<li><a href="#security-inherit-csp"><span class="secno">7.8</span> <span class="content"> CSP Inheriting to avoid bypasses </span></a>
</ol>
<li>
<a href="#authoring-considerations"><span class="secno">8</span> <span class="content">Authoring Considerations</span></a>
Expand Down Expand Up @@ -2513,12 +2514,12 @@ <h4 class="heading settled algorithm" data-algorithm="Initialize a Document&apos
<p>For each <var>policy</var> in <var>doc</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-csp-list" id="ref-for-concept-document-csp-list①">CSP list</a>:</p>
<ol>
<li data-md="">
<p>Insert an alias to <var>policy</var> in <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-csp-list" id="ref-for-concept-document-csp-list②">CSP list</a>.</p>
<p>Insert a copy of <var>policy</var> into <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-csp-list" id="ref-for-concept-document-csp-list②">CSP list</a>.</p>
</ol>
</ol>
</ol>
<p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#local-scheme" id="ref-for-local-scheme②">local scheme</a> includes <code>about:</code>, and this algorithm will
therefore alias the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document①">embedding document</a>’s policies for <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#an-iframe-srcdoc-document" id="ref-for-an-iframe-srcdoc-document">an iframe <code>srcdoc</code> <code>Document</code></a>.</p>
therefore copy the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document①">embedding document</a>’s policies for <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#an-iframe-srcdoc-document" id="ref-for-an-iframe-srcdoc-document">an iframe <code>srcdoc</code> <code>Document</code></a>.</p>
<p class="note" role="note"><span>Note:</span> We do all this to ensure that a page cannot bypass its <a data-link-type="dfn" href="#content-security-policy-object" id="ref-for-content-security-policy-object②④">policy</a> by embedding a frame or popping up a new window containing content it
controls (<code>blob:</code> resources, or <code>document.write()</code>).</p>
<li data-md="">
Expand Down Expand Up @@ -2552,12 +2553,12 @@ <h4 class="heading settled algorithm" data-algorithm="Initialize a global object
<p>For each <var>policy</var> in <var>owner</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑤">CSP list</a>:</p>
<ol>
<li data-md="">
<p>Insert an alias to <var>policy</var> in <var>global</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑥">CSP list</a>.</p>
<p>Insert a copy of <var>policy</var> into <var>global</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑥">CSP list</a>.</p>
</ol>
</ol>
</ol>
<p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#local-scheme" id="ref-for-local-scheme④">local scheme</a> includes <code>about:</code>, and this algorithm will
therefore alias the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document②">embedding document</a>’s policies for <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#an-iframe-srcdoc-document" id="ref-for-an-iframe-srcdoc-document①">an iframe <code>srcdoc</code> <code>Document</code></a>.</p>
therefore copy the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document②">embedding document</a>’s policies for <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#an-iframe-srcdoc-document" id="ref-for-an-iframe-srcdoc-document①">an iframe <code>srcdoc</code> <code>Document</code></a>.</p>
<li data-md="">
<p>If <var>global</var> is a <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/workers.html#sharedworkerglobalscope" id="ref-for-sharedworkerglobalscope">SharedWorkerGlobalScope</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/ServiceWorker/#serviceworkerglobalscope" id="ref-for-serviceworkerglobalscope">ServiceWorkerGlobalScope</a></code>:</p>
<ol>
Expand All @@ -2573,7 +2574,7 @@ <h4 class="heading settled algorithm" data-algorithm="Initialize a global object
<p>For each <var>policy</var> in <var>owner</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑧">CSP list</a>:</p>
<ol>
<li data-md="">
<p>Insert an alias to <var>policy</var> in <var>global</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑨">CSP list</a>.</p>
<p>Insert a copy of <var>policy</var> into <var>global</var>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list⑨">CSP list</a>.</p>
</ol>
</ol>
</ol>
Expand Down Expand Up @@ -4953,6 +4954,31 @@ <h3 class="heading settled" data-level="7.7" id="security-secure-upgrades"><span
<p>To mitigate one variant of history-scanning attacks like Yan Zhu’s <a href="http://diracdeltas.github.io/sniffly/">Sniffly</a>, CSP will not allow pages to lock
themselves into insecure URLs via policies like <code>script-src http://example.com</code>. As described in <a href="#match-schemes">§6.6.1.7 scheme-part matching</a>, the scheme portion of a source expression will always allow upgrading to a
secure variant.</p>
<h3 class="heading settled" data-level="7.8" id="security-inherit-csp"><span class="secno">7.8. </span><span class="content"> CSP Inheriting to avoid bypasses </span><a class="self-link" href="#security-inherit-csp"></a></h3>
<p>As described in <a href="#initialize-document-csp">§4.2.1 Initialize a Document's CSP list</a> and <a href="#initialize-global-object-csp">§4.2.2 Initialize a global object’s CSP list</a>,
documents loaded from <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#local-scheme" id="ref-for-local-scheme⑤">local schemes</a> will inherit a copy of the
policies in the <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list①⑧">CSP list</a> of the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document③">embedding document</a> or <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context" id="ref-for-opener-browsing-context②">opener browsing context</a>. The goal is to ensure that a page can’t
bypass its policy by embedding a frame or opening a new window containg
content that is entirely under its control (<code>srcdoc</code> documents, <code>blob:</code> or <code>data:</code> URLs, <code>about:blank</code> documents that can be manipulated via <code>document.write()</code>, etc).</p>
<div class="example" id="example-7a5b0df0">
<a class="self-link" href="#example-7a5b0df0"></a> If this would not happen a page could execute inline scripts even without <code>unsafe-inline</code> in the page’s execution context by simply embedding a <code>srcdoc</code> <code>iframe</code>.
<pre class="highlight"><span class="p">&lt;</span><span class="nt">iframe</span> <span class="na">srcdoc</span><span class="o">=</span><span class="s">"&lt;script>alert(1);&lt;/script>"</span><span class="p">>&lt;/</span><span class="nt">iframe</span><span class="p">></span>
</pre>
</div>
<p>Note that we create a copy of the <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list①⑨">CSP list</a> which
means that the new <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document①⑨">Document</a></code>'s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list②⓪">CSP list</a> is a
snapshot of the relevant policies at its creation time. Modifications in the <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list②①">CSP list</a> of the new <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②⓪">Document</a></code> won’t affect the <a data-link-type="dfn" href="#embedding-document" id="ref-for-embedding-document④">embedding document</a> or <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context" id="ref-for-opener-browsing-context③">opener browsing context</a>’s <a data-link-type="dfn" href="#global-object-csp-list" id="ref-for-global-object-csp-list②②">CSP list</a> or vice-versa.</p>
<div class="example" id="example-3c6e0109">
<a class="self-link" href="#example-3c6e0109"></a> In the example below the image inside the iframe will not load because it is
blocked by the policy in the <code>meta</code> tag of the iframe. The image outside the
iframe will load (assuming the main page policy does not block it) since the
policy inserted in the iframe will not affect it.
<pre class="highlight"><span class="p">&lt;</span><span class="nt">iframe</span> <span class="na">srcdoc</span><span class="o">=</span><span class="s">'&lt;meta http-equiv="Content-Security-Policy" content="img-src example.com;"></span>
<span class="s"> &lt;img src="not-example.com/image">'</span><span class="p">>&lt;/</span><span class="nt">iframe</span><span class="p">></span>

<span class="p">&lt;</span><span class="nt">img</span> <span class="na">src</span><span class="o">=</span><span class="s">"not-example.com/image"</span><span class="p">></span>
</pre>
</div>
</section>
<section>
<h2 class="heading settled" data-level="8" id="authoring-considerations"><span class="secno">8. </span><span class="content">Authoring Considerations</span><a class="self-link" href="#authoring-considerations"></a></h2>
Expand Down Expand Up @@ -6953,6 +6979,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
EnsureCSPDoesNotBlockStringCompilation(callerRealm, calleeRealm, source) </a>
<li><a href="#ref-for-global-object-csp-list①⑦">6.2.1.1.
Is base allowed for document? </a>
<li><a href="#ref-for-global-object-csp-list①⑧">7.8.
CSP Inheriting to avoid bypasses </a> <a href="#ref-for-global-object-csp-list①⑨">(2)</a> <a href="#ref-for-global-object-csp-list②⓪">(3)</a> <a href="#ref-for-global-object-csp-list②①">(4)</a> <a href="#ref-for-global-object-csp-list②②">(5)</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="enforced">
Expand All @@ -6978,6 +7006,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
Initialize a Document's CSP list </a> <a href="#ref-for-embedding-document①">(2)</a>
<li><a href="#ref-for-embedding-document②">4.2.2.
Initialize a global object’s CSP list </a>
<li><a href="#ref-for-embedding-document③">7.8.
CSP Inheriting to avoid bypasses </a> <a href="#ref-for-embedding-document④">(2)</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="violation-report">
Expand Down
53 changes: 48 additions & 5 deletions index.src.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1175,11 +1175,12 @@ <h4 id="initialize-document-csp" algorithm>

1. For each |policy| in |doc|'s <a for="Document">CSP list</a>:

1. Insert an alias to |policy| in |document|'s
1. Insert a copy of |policy| into |document|'s
<a for="Document">CSP list</a>.


Note: <a>local scheme</a> includes `about:`, and this algorithm will
therefore alias the <a>embedding document</a>'s policies for <a>an iframe
therefore copy the <a>embedding document</a>'s policies for <a>an iframe
`srcdoc` `Document`</a>.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should spell this out in a little more detail in a security considerations section. Maybe something like:

As described in [[#link-to-this-section]], documents loaded from [=local schemes=] will be initialized with a copy of their opener's [=CSP list=]. The goal is both to ensure that a page can't bypass its policy by embedding a frame or popping up a new window containing content it entirely controls (srcdoc documents, blob: resources, about:blank that can be poked at via document.write(), etc). For example:

// TODO(andypaicu): Example goes here. ;)

Note that we create a copy of the relevant policies when initializing the new document's [=CSP list=]. This means that the new document's policies are a snapshot of the relevant [=CSP list=] at its creation time. It's possible that more policies could be added to the new document after initialization: these would not be applied to the opener context. Likewise, if more policies are added to the opener context, the new document's [=CSP list=] would be unaffected.

// TODO(andypaicu): Another example!

WDYT?


Note: We do all this to ensure that a page cannot bypass its <a for="/">policy</a>
Expand Down Expand Up @@ -1215,11 +1216,11 @@ <h4 id="initialize-global-object-csp" algorithm>

1. For each |policy| in |owner|'s <a for="global object">CSP list</a>:

1. Insert an alias to |policy| in |global|'s
1. Insert a copy of |policy| into |global|'s
<a for="global object">CSP list</a>.

Note: <a>local scheme</a> includes `about:`, and this algorithm will
therefore alias the <a>embedding document</a>'s policies for <a>an iframe
therefore copy the <a>embedding document</a>'s policies for <a>an iframe
`srcdoc` `Document`</a>.

2. If |global| is a {{SharedWorkerGlobalScope}} or {{ServiceWorkerGlobalScope}}:
Expand All @@ -1234,7 +1235,7 @@ <h4 id="initialize-global-object-csp" algorithm>

2. For each |policy| in |owner|'s <a for="global object">CSP list</a>:

1. Insert an alias to |policy| in |global|'s <a for="global object">CSP list</a>.
1. Insert a copy of |policy| into |global|'s <a for="global object">CSP list</a>.

<h4 id="get-csp-of-object" algorithm>
Retrieve the <a for="global object">CSP list</a> of an |object|
Expand Down Expand Up @@ -4150,6 +4151,48 @@ <h3 id="security-secure-upgrades">Secure Upgrades</h3>
themselves into insecure URLs via policies like `script-src http://example.com`. As described in
[[#match-schemes]], the scheme portion of a source expression will always allow upgrading to a
secure variant.

<h3 id="security-inherit-csp">
CSP Inheriting to avoid bypasses
</h3>

As described in [[#initialize-document-csp]] and [[#initialize-global-object-csp]],
documents loaded from <a>local schemes</a> will inherit a copy of the
policies in the <a for="global object">CSP list</a> of the <a>embedding document</a>
or <a>opener browsing context</a>. The goal is to ensure that a page can't
bypass its policy by embedding a frame or opening a new window containg
content that is entirely under its control (`srcdoc` documents, `blob:` or `data:`
URLs, `about:blank` documents that can be manipulated via `document.write()`, etc).

<div class="example">
If this would not happen a page could execute inline scripts even without
`unsafe-inline` in the page's execution context by simply embedding a `srcdoc`
`iframe`.
<pre highlight="html">
&lt;iframe srcdoc="&lt;script&gt;alert(1);&lt;/script&gt;"&gt;&lt;/iframe&gt;
</pre>
</div>

Note that we create a copy of the <a for="global object">CSP list</a> which
means that the new {{Document}}'s <a for="global object">CSP list</a> is a
snapshot of the relevant policies at its creation time. Modifications in the
<a for="global object">CSP list</a> of the new {{Document}} won't affect the
<a>embedding document</a> or <a>opener browsing context</a>'s
<a for="global object">CSP list</a> or vice-versa.

<div class="example">
In the example below the image inside the iframe will not load because it is
blocked by the policy in the `meta` tag of the iframe. The image outside the
iframe will load (assuming the main page policy does not block it) since the
policy inserted in the iframe will not affect it.
<pre highlight="html">
&lt;iframe srcdoc='&lt;meta http-equiv="Content-Security-Policy" content="img-src example.com;"&gt;
&lt;img src="not-example.com/image"&gt;'&gt;&lt;/iframe&gt;

&lt;img src="not-example.com/image"&gt;
</pre>
</div>

</section>

<!-- Big text: Authoring -->
Expand Down