2004710 - SRI interprets certain invalid integrity attributes as having incorrect hash

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

This is a reduced version of bug 2003813.

It seems like Chrome and Safari will not block css loads with integrity if the integrity field is malformed.

Comment 1

[Jeff Muizelaar [:jrmuizel]]

Attachment: styles.css

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Attachment: Test case

Comment 3

[Jeff Muizelaar [:jrmuizel]]

Attachment: Test case

Comment 4

[Malte Jürgens [:maltejur]]

It looks like this was already raised in the WPT interop repo some time ago, and the SRI WPT has already been expanded to test this.

To quote from https://github.com/web-platform-tests/interop/issues/666#issue-2325261451:

<head>
<link rel="stylesheet" href="demo.css" >
</head>

It's loading normally.

<head>
<link rel="stylesheet" href="demo.css" integrity="..." crossorigin="anonymous">
</head>

The ressource will be allowed in Chrome, FF and Safari.

<head>
<link rel="stylesheet" href="demo.css" integrity="sha256-AAA" crossorigin="anonymous">
</head>

The ressource will be blocked in all thre browers.

<head>
<link rel="stylesheet" href="demo.css" integrity="sha256-..." crossorigin="anonymous">
</head>

The ressource will be allowed in Chrome and Safari but blocked in FF.

And from https://github.com/web-platform-tests/interop/issues/666#issuecomment-2675072474:

I think the spec for this is https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute and that the problem with the integrity="sha256-..." must be that Firefox treats "..." as an invalid or mismatching SHA-256 hash, instead of rejecting the whole "sha256-..." string as not matching the ABNF grammar in the spec.

In other words, I think Firefox isn't following the spec here. I couldn't find any tests for this, so I sent web-platform-tests/wpt#50875 using your example.

Comment 5

[Malte Jürgens [:maltejur]]

Attachment: Bug 2004710 - Check that SRI hash is in base64 format r?tschuster

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5462742b3ea5
https://hg.mozilla.org/integration/autoland/rev/327e922c1a91
Check that SRI hash is in base64 format r=tschuster

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/97f2a0770ea2
https://hg.mozilla.org/integration/autoland/rev/030b567cc3a2
Revert "Bug 2004710 - Check that SRI hash is in base64 format r=tschuster" for causing mochitest failures @test_bug_1364262.html.

Comment 8

[Goloman Adrian[:agoloman]]

Backed out for causing mochitest failures @test_bug_1364262.html.

• Backout link
• Push with failures
• Failure Log

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/57c3d08ee255
https://hg.mozilla.org/integration/autoland/rev/bea52b63fdb3
Check that SRI hash is in base64 format r=tschuster

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/686314543e5d
https://hg.mozilla.org/integration/autoland/rev/22fb8c10d08c
Revert "Bug 2004710 - Check that SRI hash is in base64 format r=tschuster" for causing wpt failures on preload/modulepreload.html

Comment 11

[Cristina Horotan [:chorotan]]

Backed out for causing wpt failures on preload/modulepreload.html

Backout link

Push with failures

Failure log

Comment 12

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8fa4f67d093c
https://hg.mozilla.org/integration/autoland/rev/112c66897662
Check that SRI hash is in base64 format r=tschuster

Comment 14

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57243 for changes under testing/web-platform/tests

Comment 15

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/112c66897662

Comment 16

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot