diff --git a/index.bs b/index.bs index 5850b784be..862e6cab8b 100644 --- a/index.bs +++ b/index.bs @@ -2140,6 +2140,14 @@ this algorithm returns normally if compilation is allowed, and throws a out in more detail in the [[#should-block-request]] and [[#should-block-response]] algorithms. +
+ Resource hints such as [^link/rel/prefetch^] and [^link/rel/dns-prefetch^] generate requests that + aren't tied to any specific [=fetch directive=], but are instead governed by the union of servers + allowed in all of a policy's directives' [=source lists=]. If default-src is not specified, these + requests will always be allowed. For more information, see [[#exfiltration]]. +
+ +
The following header: @@ -2156,7 +2164,6 @@ this algorithm returns normally if compilation is allowed, and throws a img-src 'self'; manifest-src 'self'; media-src 'self'; - prefetch-src 'self'; object-src 'self'; script-src-elem 'self'; script-src-attr 'self'; @@ -2186,7 +2193,6 @@ this algorithm returns normally if compilation is allowed, and throws a img-src 'self'; manifest-src 'self'; media-src 'self'; - prefetch-src 'self'; object-src 'self'; script-src-elem https://example.com; script-src-attr 'self'; @@ -2703,74 +2709,6 @@ this algorithm returns normally if compilation is allowed, and throws a 4. Return "`Allowed`". -

`prefetch-src`

- - The prefetch-src directive restricts the URLs from which resources may be - prefetched or prerendered. The syntax for the directive's name and value is described by the - following ABNF: - - 
-    directive-name  = "prefetch-src"
-    directive-value = serialized-source-list
-
- -
- Given a page with the following Content Security Policy: - - 
-      Content-Security-Policy: prefetch-src https://example.com/
-
- - Fetches for the following code will return network errors, as the URLs provided do not match - `prefetch-src`'s source list: - - 
-      <link rel="prefetch" src="https://example.org/"></link>
-      <link rel="prerender" src="https://example.org/"></link>
-
-
- -
- `prefetch-src` Pre-request check -
- - This directive's pre-request check is as follows: - - Given a request (|request|) and a policy (|policy|): - - 1. Let |name| be the result of executing [[#effective-directive-for-a-request]] - on |request|. - - 2. If the result of executing [[#should-directive-execute]] on |name|, - `prefetch-src` and |policy| is "`No`", return "`Allowed`". - - 3. If the result of executing [[#match-request-to-source-list]] on |request|, - this directive's [=directive/value=], and |policy|, - is "`Does Not Match`", return "`Blocked`". - - 4. Return "`Allowed`". - -
- `prefetch-src` Post-request check -
- - This directive's post-request check is as follows: - - Given a request (|request|), a response (|response|), and a - policy (|policy|): - - 1. Let |name| be the result of executing [[#effective-directive-for-a-request]] - on |request|. - - 2. If the result of executing [[#should-directive-execute]] on |name|, - `prefetch-src` and |policy| is "`No`", return "`Allowed`". - - 3. If the result of executing [[#match-response-to-source-list]] on |response|, - |request|, this directive's [=directive/value=], and |policy|, - is "`Does Not Match`", return "`Blocked`". - - 4. Return "`Allowed`". -

`script-src`

The script-src directive restricts the locations from which scripts @@ -3794,16 +3732,41 @@ this algorithm returns normally if compilation is allowed, and throws a algorithm returns the violated directive if the request violates the policy, and "`Does Not Violate`" otherwise. - 1. Let |violates| be "`Does Not Violate`". + 1. If |request|'s [=request/initiator=] is "`prefetch`", then return the result of executing + [[#does-resource-hint-violate-policy]] on |request| and |policy|. + + 2. Let |violates| be "`Does Not Violate`". - 2. For each |directive| of |policy|: + 3. For each |directive| of |policy|: 1. Let |result| be the result of executing |directive|'s pre-request check on |request| and |policy|. 2. If |result| is "`Blocked`", then let |violates| be |directive|. - 3. Return |violates|. + 4. Return |violates|. + +
+ Does resource hint |request| violate |policy|? +
+ + Given a request (|request|) and a policy (|policy|), this + algorithm returns the default directive if the resource-hint request violates all the + policies, and "`Does Not Violate`" otherwise. + + 1. Let |defaultDirective| be |policy|'s first [=directive=] whose [=directive/name=] is + "`default-src`". + + 2. If |defaultDirective| does not exist, return "`Does Not Violate`". + + 3. For each |directive| of |policy|: + + 1. Let |result| be the result of executing |directive|'s + pre-request check on |request| and |policy|. + + 2. If |result| is "`Allowed`", then return "`Does Not Violate`". + + 4. Return "`Blocked`".
Does |nonce| match |source list|? @@ -4333,11 +4296,11 @@ this algorithm returns normally if compilation is allowed, and throws a `null` or the name of the request's effective directive: - 1. If |request|'s initiator is "`fetch`" or its - destination is "", return `connect-src`. + 1. If |request|'s [=request/initiator=] is "`prefetch`" or "`prerender`", + return `default-src`. - 2. If |request|'s [=request/initiator=] is "`prefetch`" or "`prerender`", - return `prefetch-src`. + 2. If |request|'s initiator is "`fetch`" or its + destination is "", return `connect-src`. 3. Switch on |request|'s destination, and execute the associated steps: @@ -4460,10 +4423,6 @@ this algorithm returns normally if compilation is allowed, and throws a :: 1. Return `<< "manifest-src", "default-src" >>`. - : "`prefetch-src`" - :: - 1. Return `<< "prefetch-src", "default-src" >>`. - : "`object-src`" :: 1. Return `<< "object-src", "default-src" >>`. @@ -5015,8 +4974,45 @@ this algorithm returns normally if compilation is allowed, and throws a
+
+

+ Exfiltration +

+ + Data exfiltration can occur when the contents of the request, such as the URL, contain + information about the user or page that should be restricted and not shared. + + Content Security Policy can mitigate data exfiltration if used to create allowlists of servers + with which a page is allowed to communicate. Note that a policy which lacks the default-src + directive cannot mitigate exfiltration, as there are kinds of requests that are not addressable + through a more-specific directive ([^link/rel/prefetch^], for example). + +
+ In the following example, a policy with draconian restrictions on images, fonts, and scripts + can still allow data exfiltration via other request types (`fetch()`, [^link/rel/prefetch^], etc): + + 
+        Content-Security-Policy: img-src 'none' script-src 'none' font-src 'none'
+
+ + Supplementing this policy with `default-src 'none'` would improve the page's robustness + against this kind of attack. +
+ +
+ In the following example, the default-src directive appears to protect from + exfiltration, however the img-src directive relaxes this restriction by using a + wildcard, which allows data exfiltration to arbitrary endpoints. A policy's exfiltration + mitigation ability depends upon the least-restrictive directive allowlist: + + 
+        Content-Security-Policy: default-src 'none'; img-src *
+
+
+ +

Implementation Considerations