Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use frame url for scripts without sources #17979

Merged
merged 3 commits into from
Apr 12, 2023
Merged

Use frame url for scripts without sources #17979

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
edf39ee
Use frame url for scripts without sources
spylogsster Apr 10, 2023
237bffd
Use GetSecurityOrigin
spylogsster Apr 10, 2023
943c7b3
Added test for subframe
spylogsster Apr 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions browser/brave_shields/brave_shields_web_contents_observer_browsertest.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,4 +277,53 @@ IN_PROC_BROWSER_TEST_F(BraveShieldsWebContentsObserverBrowserTest,
EXPECT_EQ(brave_shields_web_contents_observer()->block_javascript_count(), 0);
}

IN_PROC_BROWSER_TEST_F(BraveShieldsWebContentsObserverBrowserTest,
JavaScriptAllowedDataUrls) {
const GURL& url = GURL("a.com");

// Start with JavaScript blocking initially disabled.
ContentSetting block_javascript_setting =
content_settings()->GetContentSetting(url, url,
ContentSettingsType::JAVASCRIPT);
EXPECT_EQ(CONTENT_SETTING_ALLOW, block_javascript_setting);

// Enable JavaScript blocking globally now.
content_settings()->SetContentSettingCustomScope(
ContentSettingsPattern::Wildcard(), ContentSettingsPattern::Wildcard(),
ContentSettingsType::JAVASCRIPT, CONTENT_SETTING_BLOCK);
block_javascript_setting = content_settings()->GetContentSetting(
url, url, ContentSettingsType::JAVASCRIPT);
EXPECT_EQ(CONTENT_SETTING_BLOCK, block_javascript_setting);

// Load a simple HTML that attempts to load some JavaScript with data urls.
auto page_url =
embedded_test_server()->GetURL("a.com", "/load_js_dataurls.html");
EXPECT_TRUE(ui_test_utils::NavigateToURL(browser(), page_url));
EXPECT_TRUE(WaitForLoadStop(GetWebContents()));
EXPECT_EQ(brave_shields_web_contents_observer()->block_javascript_count(), 4);
brave_shields_web_contents_observer()->Reset();
// Allow subframe script and check we still block his data urls.
std::string subframe_script =
url::Origin::Create(page_url).Serialize() + "/load_js_dataurls.js";
brave_shields_web_contents_observer()->AllowScriptsOnce(
std::vector<std::string>({subframe_script}));
ClearAllResourcesList();
GetWebContents()->GetController().Reload(content::ReloadType::NORMAL, true);
EXPECT_TRUE(WaitForLoadStop(GetWebContents()));
EXPECT_EQ(GetBlockedJsList().size(), 1u);
EXPECT_EQ(GetAllowedJsList().size(), 1u);
EXPECT_EQ(brave_shields_web_contents_observer()->block_javascript_count(), 3);
brave_shields_web_contents_observer()->Reset();

// Allow all scripts for domain.
brave_shields_web_contents_observer()->AllowScriptsOnce(
std::vector<std::string>({url::Origin::Create(page_url).Serialize()}));
ClearAllResourcesList();
GetWebContents()->GetController().Reload(content::ReloadType::NORMAL, true);
EXPECT_TRUE(WaitForLoadStop(GetWebContents()));

EXPECT_EQ(GetAllowedJsList().size(), 2u);
EXPECT_EQ(brave_shields_web_contents_observer()->block_javascript_count(), 0);
}

} // namespace brave_shields
10 changes: 9 additions & 1 deletion components/content_settings/renderer/brave_content_settings_agent_impl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,15 @@ bool BraveContentSettingsAgentImpl::AllowStorageAccessSync(
bool BraveContentSettingsAgentImpl::AllowScriptFromSource(
bool enabled_per_settings,
const blink::WebURL& script_url) {
const GURL secondary_url(script_url);
GURL secondary_url(script_url);
// For scripts w/o sources it should report the domain / site used for
// executing the frame (which most, but not all, of the time will just be from
// document.location
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uber-nit, here: you forgot the closing ) in the source comment, after // document.location)

if (secondary_url.SchemeIsLocal()) {
secondary_url =
url::Origin(render_frame()->GetWebFrame()->GetSecurityOrigin())
.GetURL();
}
bool allow = ContentSettingsAgentImpl::AllowScriptFromSource(
enabled_per_settings, script_url);

Expand Down
9 changes: 9 additions & 0 deletions test/data/load_js_dataurls.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
<html><head><title>load some js code</title></head>
<body>
<!--
Just attempt to load a JavaScript to test JavaScript blocking.
-->
<script src="data:application/javascript;base64,Y29uc29sZS5sb2coImhlbGxvIGZyb20gYmxvY2tlZCBzY3JpcHQiKQ=="></script>
<script src="load_js_dataurls.js"></script>
</body>
</html>
14 changes: 14 additions & 0 deletions test/data/load_js_dataurls.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
/* Copyright (c) 2023 The Brave Authors. All rights reserved.
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at https://mozilla.org/MPL/2.0/. */

var iframe = document.createElement('IFRAME');
iframe.id = iframe.name = 'test_iframe';
iframe.src = 'about:blank';
document.body.appendChild(iframe);

var frame = window.frames['test_iframe'];
frame.document.open();
frame.document.write('<script>console.log("message from frame:", document.location.href)</script>');
frame.document.close();