Issue 663620: Bypass unsafe-inline mode CSP

Hey mkwst@, would you mind taking a look at this one?

CSP doesn't restrict `prefetch`, `prerender`, `dns-prefetch`, or `preconnect`. It's arguable that it should (and we're talking some of those in https://github.com/w3c/webappsec-csp/issues/107, where your opinions would certainly be appreciated).

`preload` should require an `as` attribute, and apply policy accordingly. yoav@, can you take a look at whether that's happening?

preload should apply policy according to the `as` attribute. If that attribute is missing, the applied policy should be `connect-src`.

Is there a test case that shows that this is not happening?

Attackers do not need to use the as attribute when attacking

True. Again, if that attribute is missing, the applied policy should be `connect-src`. If that's not the case, it's certainly a bug. Is this what you see? Do you have a test case that shows that?

See http://45.32.32.225/test.php

Content-Security-Policy:default-src 'self'; content-src 'none'; script-src 'self' 'unsafe-inline';

It can send a request to asd11111111a1121.vqn3j8.ceye.io .

PoC:
http://45.32.32.225/test2.php#<link rel=preload href=http://asd11111111a1121.vqn3j8.ceye.io/test.aaa>

Can recreate using my own test case.

I assume this impacts stable - let me know if I'm mistaken.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/872f27a9bceebb042082cd1b2f9043e5dd208200

commit 872f27a9bceebb042082cd1b2f9043e5dd208200
Author: yoav <yoav@yoav.ws>
Date: Tue Nov 15 10:07:46 2016

Apply connect-src for link preload with no `as` value

This fixes an issue where connect-src was not applied to preloaded resources, due to their Context.

BUG= 663620 

Review-Url: https://codereview.chromium.org/2491903002
Cr-Commit-Position: refs/heads/master@{#432158}

[modify] https://crrev.com/872f27a9bceebb042082cd1b2f9043e5dd208200/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
[modify] https://crrev.com/872f27a9bceebb042082cd1b2f9043e5dd208200/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/872f27a9bceebb042082cd1b2f9043e5dd208200

commit 872f27a9bceebb042082cd1b2f9043e5dd208200
Author: yoav <yoav@yoav.ws>
Date: Tue Nov 15 10:07:46 2016

Apply connect-src for link preload with no `as` value

This fixes an issue where connect-src was not applied to preloaded resources, due to their Context.

BUG= 663620 

Review-Url: https://codereview.chromium.org/2491903002
Cr-Commit-Position: refs/heads/master@{#432158}

[modify] https://crrev.com/872f27a9bceebb042082cd1b2f9043e5dd208200/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
[modify] https://crrev.com/872f27a9bceebb042082cd1b2f9043e5dd208200/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp

Anything else to be done here, or can we mark as Fixed?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

 Issue 719242  has been merged into this issue.