Issue metadata
Sign in to add a comment
|
Security: Service workers do not respect 'unsafe-eval' in their CSP |
||||||||||||||||||||||
Issue description
VULNERABILITY DETAILS
I can't imagine this leading to an actual problem, but the behavior was surprising to me so here goes:
Service workers obey the policy sent in the HTTP response which returns the service worker. For example, if the SW has a CSP and tries to call importScripts('foo.js') this will fail unless the CSP contains script-src 'self'.
However, restrictions on eval() (e.g. script-src 'none', *without* 'unsafe-eval') have no effect on SWs. Serving a worker with such a policy still allows it to call eval() and does not cause a CSP violation; I believe it should do so.
VERSION
Chrome Version: Tested on M57, M59 (59.0.3053.3)
Operating System: Linux (Ubuntu)
REPRODUCTION CASE
HTML:
<head>
<meta http-equiv="content-security-policy"
content="script-src 'nonce-foo' 'self'; worker-src *">
</head>
<script nonce=foo>
navigator.serviceWorker.register('/cgi-bin/service-worker-with-csp.py',
{scope: '/cgi-bin/'}).then(function(registration) {
console.log('SW registered');
}).catch(function(error) {
console.log('SW error');
});
</script>
JS:
#!/usr/bin/python
import cgi
import cgitb
cgitb.enable()
print """\
Content-Type: text/javascript; charset=utf-8
Content-Security-Policy: script-src 'self';
console.log(eval(1));
self.importScripts('service-worker-foo.py');
"""
Output:
> 1
> SW registered
,
Apr 3 2017
,
Apr 3 2017
,
Apr 4 2017
,
Apr 5 2017
Quick update: I just noticed that in Chrome CSP blocks eval(String) but not eval(Number) or eval(Object). This is probably fine and consistent with what I saw above, so I assume this is WAI...
,
Apr 6 2017
Jochen knows things about V8 and eval and types. Sooooo....
,
Apr 6 2017
https://tc39.github.io/ecma262/#sec-performeval step 2 says if the arg of eval() is not a string to return the arg verbatim. would you like CSP to block that behavior as well?
,
Apr 7 2017
filed https://github.com/w3c/webappsec-csp/issues/201 to track the spec issue, closing this issue for now
,
Apr 10 2017
Sounds good, thanks for taking a look!
,
Jul 14 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by sheriffbot@chromium.org
, Apr 2 2017