Skip to content

Commit b2183e3

Browse files
mikewestmoz-wptsync-bot
mikewest
authored and
moz-wptsync-bot
committed
Bug 1956065 [wpt PR 51557] - [SRI Message Signatures] Support the @scheme derived component., a=testonly
Automatic update from web-platform-tests [SRI Message Signatures] Support the `@scheme` derived component. This CL adds support for the `@scheme` derived component, as defined in https://www.rfc-editor.org/rfc/rfc9421.html#name-scheme Bug: 383409584 Change-Id: I09d197a33da89c2a789f44b83e179ed85922fddc Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6387436 Reviewed-by: Joe DeBlasio <[email protected]> Commit-Queue: Mike West <[email protected]> Cr-Commit-Position: refs/heads/main@{#1436909} -- wpt-commits: b3b205f6855e3caaad112845efb93610e3ef391a wpt-pr: 51557
1 parent 45c0c22 commit b2183e3

File tree

4 files changed

+100
-28
lines changed

4 files changed

+100
-28
lines changed

‎testing/web-platform/tests/subresource-integrity/signatures/tentative/client-initiated.cross-origin.window.js‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@
2626
// Unsigned responses are blocked when integrity is asserted:
2727
generate_fetch_test({},
2828
{
29-
host: get_host_info().REMOTE_HOST,
29+
origin: get_host_info().REMOTE_ORIGIN,
3030
integrity: `ed25519-${kValidKeys['rfc']}`,
3131
},
3232
EXPECT_BLOCKED,
3333
"No signature, valid integrity check, w/o cors: blocked.");
3434
generate_fetch_test({ cors: true },
3535
{
36-
host: get_host_info().REMOTE_HOST,
36+
origin: get_host_info().REMOTE_ORIGIN,
3737
mode: 'cors',
3838
integrity: `ed25519-${kValidKeys['rfc']}`,
3939
},
@@ -51,23 +51,23 @@ const kRequestWithValidSignature = {
5151
};
5252
generate_fetch_test(kRequestWithValidSignature,
5353
{
54-
host: get_host_info().REMOTE_HOST,
54+
origin: get_host_info().REMOTE_ORIGIN,
5555
integrity: `ed25519-${kValidKeys['rfc']}`,
5656
},
5757
EXPECT_BLOCKED,
5858
"Valid signature, matching integrity check, no cors: blocked.");
5959

6060
generate_fetch_test(kRequestWithValidSignature,
6161
{
62-
host: get_host_info().REMOTE_HOST,
62+
origin: get_host_info().REMOTE_ORIGIN,
6363
integrity: `ed25519-${kInvalidKey}`,
6464
},
6565
EXPECT_BLOCKED,
6666
"Valid signature, mismatched integrity check, no cors: blocked.");
6767

6868
generate_fetch_test(kRequestWithValidSignature,
6969
{
70-
host: get_host_info().REMOTE_HOST,
70+
origin: get_host_info().REMOTE_ORIGIN,
7171
integrity:`ed25519-${kValidKeys['rfc']} ed25519-${kInvalidKey}`
7272
},
7373
EXPECT_BLOCKED,
@@ -83,7 +83,7 @@ const kRequestWithValidSignatureAndCORS = {
8383
};
8484
generate_fetch_test(kRequestWithValidSignatureAndCORS,
8585
{
86-
host: get_host_info().REMOTE_HOST,
86+
origin: get_host_info().REMOTE_ORIGIN,
8787
mode: "cors",
8888
integrity: `ed25519-${kValidKeys['rfc']}`,
8989
},
@@ -92,7 +92,7 @@ generate_fetch_test(kRequestWithValidSignatureAndCORS,
9292

9393
generate_fetch_test(kRequestWithValidSignatureAndCORS,
9494
{
95-
host: get_host_info().REMOTE_HOST,
95+
origin: get_host_info().REMOTE_ORIGIN,
9696
mode: "cors",
9797
integrity: `ed25519-${kInvalidKey}`,
9898
},
@@ -101,7 +101,7 @@ generate_fetch_test(kRequestWithValidSignatureAndCORS,
101101

102102
generate_fetch_test(kRequestWithValidSignatureAndCORS,
103103
{
104-
host: get_host_info().REMOTE_HOST,
104+
origin: get_host_info().REMOTE_ORIGIN,
105105
mode: "cors",
106106
integrity:`ed25519-${kValidKeys['rfc']} ed25519-${kInvalidKey}`
107107
},
@@ -118,23 +118,23 @@ const kRequestWithInvalidSignature = {
118118
};
119119
generate_fetch_test(kRequestWithInvalidSignature,
120120
{
121-
host: get_host_info().REMOTE_HOST,
121+
origin: get_host_info().REMOTE_ORIGIN,
122122
integrity: `ed25519-${kValidKeys['rfc']}`,
123123
},
124124
EXPECT_BLOCKED,
125125
"Invalid signature, matching integrity check, no cors: blocked.");
126126

127127
generate_fetch_test(kRequestWithInvalidSignature,
128128
{
129-
host: get_host_info().REMOTE_HOST,
129+
origin: get_host_info().REMOTE_ORIGIN,
130130
integrity: `ed25519-${kInvalidKey}`,
131131
},
132132
EXPECT_BLOCKED,
133133
"Invalid signature, mismatched integrity check, no cors: blocked.");
134134

135135
generate_fetch_test(kRequestWithInvalidSignature,
136136
{
137-
host: get_host_info().REMOTE_HOST,
137+
origin: get_host_info().REMOTE_ORIGIN,
138138
integrity:`ed25519-${kValidKeys['rfc']} ed25519-${kInvalidKey}`
139139
},
140140
EXPECT_BLOCKED,
@@ -149,7 +149,7 @@ const kRequestWithInvalidSignatureAndCORS = {
149149
};
150150
generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
151151
{
152-
host: get_host_info().REMOTE_HOST,
152+
origin: get_host_info().REMOTE_ORIGIN,
153153
integrity: `ed25519-${kValidKeys['rfc']}`,
154154
mode: "cors",
155155
},
@@ -158,7 +158,7 @@ generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
158158

159159
generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
160160
{
161-
host: get_host_info().REMOTE_HOST,
161+
origin: get_host_info().REMOTE_ORIGIN,
162162
integrity: `ed25519-${kInvalidKey}`,
163163
mode: "cors",
164164
},
@@ -167,7 +167,7 @@ generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
167167

168168
generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
169169
{
170-
host: get_host_info().REMOTE_HOST,
170+
origin: get_host_info().REMOTE_ORIGIN,
171171
integrity:`ed25519-${kValidKeys['rfc']} ed25519-${kInvalidKey}`,
172172
mode: "cors",
173173
},

‎testing/web-platform/tests/subresource-integrity/signatures/tentative/helper.js‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,12 @@ const kAcceptSignature = "accept-signature";
5353
// Given `{ digest: "...", body: "...", cors: true, type: "..." }`, generates
5454
// the URL to a script resource that has the given characteristics.
5555
let counter = 0;
56-
function resourceURL(data, host) {
56+
function resourceURL(data, server_origin) {
5757
counter++;
5858
data.type ??= "application/javascript";
5959
data.counter = counter;
6060
let params = new URLSearchParams(data);
61-
let result = new URL("/subresource-integrity/signatures/resource.py?" + params.toString(), self.location);
62-
if (host) {
63-
result.host = host;
64-
}
61+
let result = new URL("/subresource-integrity/signatures/resource.py?" + params.toString(), server_origin ?? self.location.origin);
6562
return result.href;
6663
}
6764

@@ -92,10 +89,12 @@ async function signSignatureBase(signatureBase, privateKeyJWK) {
9289

9390
function generate_fetch_test(request_data, options, expectation, description) {
9491
promise_test(test => {
95-
const url = resourceURL(request_data, options.host);
92+
const url = resourceURL(request_data, options.origin);
9693
let fetch_options = {};
9794
if (options.mode) {
9895
fetch_options.mode = options.mode;
96+
} else if (options.origin) {
97+
fetch_options.mode = "cors";
9998
}
10099
if (options.integrity) {
101100
fetch_options.integrity = options.integrity;

‎testing/web-platform/tests/subresource-integrity/signatures/tentative/scheme.window.js‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// META: script=/common/get-host-info.sub.js
2+
// META: script=helper.js
3+
4+
// The following tests validate the behavior of the `@scheme` derived component.
5+
// They'll all be rooted in the following response, generated using the steps at
6+
// https://wicg.github.io/signature-based-sri/#examples, relying on the test
7+
// key from https://www.rfc-editor.org/rfc/rfc9421.html#name-example-ed25519-test-key:
8+
//
9+
// ```
10+
// NOTE: '\' line wrapping per RFC 8792
11+
//
12+
// HTTP/1.1 200 OK
13+
// Date: Tue, 20 Apr 2021 02:07:56 GMT
14+
// Content-Type: application/json
15+
// Unencoded-Digest: sha-256=:PZJ+9CdAAIacg7wfUe4t/RkDQJVKM0mCZ2K7qiRhHFc=:
16+
// Content-Length: 18
17+
// Signature-Input: signature=("unencoded-digest";sf "@scheme";req); \
18+
// keyid="JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="; \
19+
// tag="sri"
20+
// Signature: signature=:oVQ+s/OqXLAVdfvgZ3HaPiyzkpNXZSit9l6e1FB/gOOL3t8FOrIRDV \
21+
// CkcIEcJjd3MA1mROn39/WQShTmnKmlDg==:
22+
//
23+
//
24+
// window.hello = `world`;
25+
// ```
26+
27+
const test_cases = [
28+
// ```
29+
// "unencoded-digest";sf: sha-256=:PZJ+9CdAAIacg7wfUe4t/RkDQJVKM0mCZ2K7qiRhHFc=:
30+
// "@scheme";req: http
31+
// "@signature-params": ("unencoded-digest";sf "@scheme";req);keyid="JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";tag="sri"
32+
// ```
33+
{
34+
origin: get_host_info().HTTP_REMOTE_ORIGIN,
35+
signature: `signature=:WZp87p7X3ELfgIKL/qxsY/CT6XArMvZRaxcJ3uy1QklEcLf0c8tol2+W2pvaXX4jnd7hGevFVkzWE77rCOIzAA==:`,
36+
},
37+
// ```
38+
// "unencoded-digest";sf: sha-256=:PZJ+9CdAAIacg7wfUe4t/RkDQJVKM0mCZ2K7qiRhHFc=:
39+
// "@scheme";req: https
40+
// "@signature-params": ("unencoded-digest";sf "@scheme";req);keyid="JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";tag="sri"
41+
// ```
42+
{
43+
origin: get_host_info().HTTPS_REMOTE_ORIGIN,
44+
signature: `signature=:lMzR8lIXYG0Iz0MmTXcRTcBfNw6TgBAPfaNLAU1LzsxWC5dlez8SNe7aCW7avHTWKgaqTGBCMW1LgxkHlijgDA==:`,
45+
}
46+
]
47+
48+
// Valid signatures depend upon integrity checks.
49+
//
50+
// We're testing our handling of malformed and multiple keys generally in
51+
// the broader `client-initiated.*` tests. Here we'll just focus on ensuring
52+
// that responses with `@scheme` components load at all (no integrity check),
53+
// load when integrity checks match, and fail when integrity checks mismatch.
54+
for (const test_case of test_cases) {
55+
const request = {
56+
cors: true,
57+
body: "window.hello = `world`;",
58+
digest: "sha-256=:PZJ+9CdAAIacg7wfUe4t/RkDQJVKM0mCZ2K7qiRhHFc=:",
59+
signatureInput: `signature=("unencoded-digest";sf "@scheme";req);keyid="${kValidKeys['rfc']}";tag="sri"`,
60+
signature: test_case.signature
61+
};
62+
63+
// fetch():
64+
generate_fetch_test(request, {origin: test_case.origin}, EXPECT_LOADED,
65+
`Valid signature (${request.signature}), no integrity check: loads.`);
66+
generate_fetch_test(request, {origin: test_case.origin,
67+
integrity:`ed25519-${kValidKeys['rfc']}`}, EXPECT_LOADED,
68+
`Valid signature (${request.signature}), matching integrity check: loads.`);
69+
70+
generate_fetch_test(request, {origin: test_case.origin,
71+
integrity:`ed25519-${kInvalidKey}`}, EXPECT_BLOCKED,
72+
`Valid signature (${request.signature}), mismatched integrity check: blocked.`);
73+
}

‎testing/web-platform/tests/subresource-integrity/signatures/tentative/server-initiated.window.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,14 @@ generate_fetch_test(kRequestWithValidSignature,
3838
"Valid signature, same-origin: loads.");
3939
generate_fetch_test(kRequestWithValidSignature,
4040
{
41-
host: get_host_info().REMOTE_HOST,
41+
origin: get_host_info().REMOTE_ORIGIN,
4242
mode: "no-cors",
4343
},
4444
EXPECT_LOADED,
4545
"Valid signature, cross-origin w/o cors, mode: no-cors: loads.");
4646
generate_fetch_test(kRequestWithValidSignature,
4747
{
48-
host: get_host_info().REMOTE_HOST,
48+
origin: get_host_info().REMOTE_ORIGIN,
4949
mode: "cors",
5050
},
5151
EXPECT_BLOCKED,
@@ -65,14 +65,14 @@ generate_fetch_test(kRequestWithValidSignatureAndCORS,
6565
"Valid signature, same-origin w/ cors: loads.");
6666
generate_fetch_test(kRequestWithValidSignatureAndCORS,
6767
{
68-
host: get_host_info().REMOTE_HOST,
68+
origin: get_host_info().REMOTE_ORIGIN,
6969
mode: "no-cors",
7070
},
7171
EXPECT_LOADED,
7272
"Valid signature, cross-origin w/ cors, mode: no-cors: loads.");
7373
generate_fetch_test(kRequestWithValidSignatureAndCORS,
7474
{
75-
host: get_host_info().REMOTE_HOST,
75+
origin: get_host_info().REMOTE_ORIGIN,
7676
mode: "cors",
7777
},
7878
EXPECT_LOADED,
@@ -91,14 +91,14 @@ generate_fetch_test(kRequestWithInvalidSignature,
9191
"Invalid signature, same-origin: blocked.");
9292
generate_fetch_test(kRequestWithInvalidSignature,
9393
{
94-
host: get_host_info().REMOTE_HOST,
94+
origin: get_host_info().REMOTE_ORIGIN,
9595
mode: "no-cors",
9696
},
9797
EXPECT_BLOCKED,
9898
"Invalid signature, cross-origin w/o cors, mode: no-cors: blocked.");
9999
generate_fetch_test(kRequestWithInvalidSignature,
100100
{
101-
host: get_host_info().REMOTE_HOST,
101+
origin: get_host_info().REMOTE_ORIGIN,
102102
mode: "cors",
103103
},
104104
EXPECT_BLOCKED,
@@ -118,14 +118,14 @@ generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
118118
"Invalid signature, same-origin w/ cors: blocked.");
119119
generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
120120
{
121-
host: get_host_info().REMOTE_HOST,
121+
origin: get_host_info().REMOTE_ORIGIN,
122122
mode: "no-cors",
123123
},
124124
EXPECT_BLOCKED,
125125
"Invalid signature, cross-origin w/ cors, mode: no-cors: blocked.");
126126
generate_fetch_test(kRequestWithInvalidSignatureAndCORS,
127127
{
128-
host: get_host_info().REMOTE_HOST,
128+
origin: get_host_info().REMOTE_ORIGIN,
129129
mode: "cors",
130130
},
131131
EXPECT_BLOCKED,

0 commit comments

Comments
 (0)