From 6194d0f9f11ce968d618138e942c9ec7b73aa092 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Tue, 17 May 2022 14:08:43 +0200 Subject: [PATCH] Define opaque-response blocking This is good enough for early review, but there are a number of issues that still need resolving: https://github.com/annevk/orb/labels/mvp. There are also some inline TODO comments. A PR against HTML is needed to ensure it passes the appropriate metadata for media element and classic script requests. We might also want to depend on HTML for parsing JavaScript. --- fetch.bs | 217 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 216 insertions(+), 1 deletion(-) diff --git a/fetch.bs b/fetch.bs index 275cae0e4..93bdc5540 100644 --- a/fetch.bs +++ b/fetch.bs @@ -33,6 +33,11 @@ urlPrefix:https://w3c.github.io/hr-time/#;spec:hr-time url:dfn-coarsened-shared-current-time;text:coarsened shared current time url:dfn-unsafe-shared-current-time;text:unsafe shared current time type:typedef;url:dom-domhighrestimestamp;text:DOMHighResTimeStamp + +urlPrefix: https://tc39.es/ecma262/;type:dfn;spec:ecma-262 + url:sec-parsetext;text:ParseText + url:prod-Script;text:Script + url:script-record;text:Script Record 
@@ -1844,6 +1849,17 @@ Unless stated otherwise, it is false.
 
 
This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]]
 
+
A request has an associated
+no-cors media request state ...
+
+
This is for exclusive use by the opaque-response-safelist check.
+
+
A request has an associated
+no-cors JavaScript fallback encoding (an encoding). Unless
+stated otherwise, it is UTF-8.
+
+
This is for exclusive use by the opaque-response-safelist check.
+
 

 
 
A request has an associated
@@ -2876,6 +2892,198 @@ run these steps:
 
 
 
+
Opaque-response blocking

+
+

+ 
Opaque-response blocking, also known as ORB, is a network filter that blocks access
+ to opaque filtered responses. These responses would likely would not have been useful to the
+ fetching party. Blocking them reduces information leakage to potential attackers.
+
+ 
Essentially, CSS, JavaScript, images, and media (audio and video) can be requested across
+ origins without the CORS protocol. And unfortunately except for CSS there is no MIME type
+ enforcement. This algorithm aims to block as many responses as possible that are not one of these
+ types (or are newer variants of those types) to avoid leaking their contents through side channels.
+
+ 
The network filter combines pro-active blocking based on response headers, sniffing a limited
+ set of bytes, and ultimately falls back to a full parse due to unfortunate (lack of) design
+ decisions in the early days of the web platform. As a result there are still quite a few responses
+ whose secrets can end up being revealed to attackers. Web developers are strongly encouraged to use
+ the `Cross-Origin-Resource-Policy` response header to defend them.
+

+
+
+
The opaque-response-safelist check

+
+
The opaque-response-safelist check, given a request request
+and a response response, is to run these steps:
+
+
    
+ 
  1. Let mimeType be the result of extracting a MIME type from
+ response's header list.
+
+ 
  2. Let nosniff be the result of determining nosniff given
+ response's header list.
+
+ 
  3. 
+  
    If mimeType is not failure, then:
+
+  
      
+   
    1. If mimeType is an opaque-response-safelisted MIME type, then return
+   true.
+
+   
    2. If mimeType is an opaque-response-blocklisted-never-sniffed MIME type,
+   then return false.
+
+   
    3. If response's status is 206 and mimeType is an
+   opaque-response-blocklisted MIME type, then return false.
+
+   
    4. If nosniff is true and mimeType is an
+   opaque-response-blocklisted MIME type or its essence is
+   "text/plain", then return false.
+  
    
+
+ 
  4. If request's no-cors media request state is
+ "subsequent", then return true.
+
+ 
  5. If response's status is 206 and
+ validate a partial response given 0 and response returns invalid, then return
+ false.
+ 
+
+ 
  6. Wait for 1024 bytes of response's body or end-of-file,
+ whichever comes first and let bytes be those bytes.
+ 
+
+ 
  7. 
+  
    If the audio or video type pattern matching algorithm given bytes does not
+  return undefined, then:
+
+  
      
+   
    1. If requests's no-cors media request state is not
+   "initial", then return false.
+
+   
    2. If response's status is not 200 or 206, then return false.
+
+   
    3. Return true.
+  
    
+
+ 
  8. If requests's no-cors media request state is not
+ "N/A", then return false.
+
+ 
  9. If the image type pattern matching algorithm given bytes does not return
+ undefined, then return true.
+
+ 
  10. 
+  
    If nosniff is true, then return false.
+
+  
    This check is made late as unfortunately images and media are always sniffed.
+
+ 
  11. If response's status is not an ok status, then return
+ false.
+
+ 
  12. 
+  
    If mimeType is failure, then return true.
+
+  
    This could be improved at somewhat significant cost. See
+  annevk/orb #28.
+
+ 
  13. If mimeType's essence starts with
+ "audio/", "image/", or "video/", then return false.
+
+ 
  14. Let responseBodyBytes be null.
+
+ 
  15. 
+  
    Let processBody given a byte sequence bytes be these steps:
+
+  
      
+   
    1. Set responseBodyBytes to bytes.
+
+   
    2. Set response's body to the body
+   of the result of safely extracting bytes.
+  
    
+
+ 
  16. Let processBodyError be this step: set responseBodyBytes to failure.
+
+ 
  17. Fully read response's body given processBody
+ and processBodyError.
+
+ 
  18. Wait for responseBodyBytes to be non-null.
+
+ 
  19. If responseBodyBytes is failure, then return false.
+
+ 
  20. Assert: responseBodyBytes is a byte sequence.
+
+ 
  21. If parse JSON bytes to a JavaScript value given responseBodyBytes does not
+ throw, then return false. If it throws, catch the exception and ignore it.
+
+ 
  22. Let sourceText be the result of decoding
+ responseBodyBytes given request's
+ no-cors JavaScript fallback encoding.
+
+ 
  23. If ParseText(sourceText, Script) returns a Script Record,
+ then return true.
+ 
+
+ 
  24. Return false.
+

+
+
+
New MIME type sets

+
+
The definitions in this section are solely for the purpose of abstracting parts of the
+opaque-response-safelist check. They are not suited for usage elsewhere.
+
+
An opaque-response-safelisted MIME type is a JavaScript MIME type or a
+MIME type whose essence is "text/css" or
+"image/svg+xml".
+
+
An opaque-response-blocklisted MIME type is an HTML MIME type,
+JSON MIME type, or XML MIME type.
+
+
An opaque-response-blocklisted-never-sniffed MIME type is a MIME type
+whose essence is one of:
+
+

+
+
 
 
HTTP extensions

 
@@ -4081,8 +4289,14 @@ steps:
 
      
  • Set request's response tainting to "opaque".
 
-     
  • Return the result of running scheme fetch given fetchParams.
+     
  • Let opaqueResponse be the result of running scheme fetch given
+     fetchParams.
      
+
+     
  • If the opaque-response-safelist check given request and
+     opaqueResponse returns true, then return opaqueResponse.
+
+     
  • Return a network error.
     
 
    
    request's current URL's scheme is not an
@@ -8346,6 +8560,7 @@ Mohamed Zergaoui,
 Mohammed Zubair Ahmed,
 Moritz Kneilmann,
 Ms2ger,
+Nathan Froyd,
 Nico Schlömer,
 Nicolás Peña Moreno,
 Nikhil Marathe,