From 13b52743e6214d40a7eddf7d099616116f4c7954 Mon Sep 17 00:00:00 2001
From: Mike West <[email protected]>
Date: Fri, 10 Apr 2026 04:07:02 -0700
Subject: [PATCH] [SRI Message Signatures] Require an enforceable `Unencoded-Digest`.

If the `Unencoded-Digest` header contains an unknown algorithm, we can't
enforce its assertions on the content we download. This enables forward
compatibility with new algorithms, but also opens a hole in signature
checks, insofar as the signature over an unenforceable digest is equally
unenforceable. Here, we follow the spec change in [1] to require
enforcability.

[1]: https://github.com/WICG/signature-based-sri/commit/c6300af60c5ece3a79cc18a9f9f4af5828c393ad

Bug: 498080391
Change-Id: I7422e261831cd1af0da9fb97c603350733cff262
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7734936
Reviewed-by: Antonio Sartori <[email protected]>
Commit-Queue: Mike West <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1612754}
---

diff --git a/services/network/public/cpp/sri_message_signatures.cc b/services/network/public/cpp/sri_message_signatures.cc
index 8445b1f..d515adec 100644
--- a/services/network/public/cpp/sri_message_signatures.cc
+++ b/services/network/public/cpp/sri_message_signatures.cc
@@ -862,6 +862,16 @@
   }
 
   if (passed_validation) {
+    // If we have signatures that matched expected keys, they MUST have a
+    // usable unencoded-digest. ParseSRIMessageSignaturesFromHeaders enforces
+    // that all parsed signatures cover `unencoded-digest`. If we don't have
+    // any supported digests, we can't verify the body, so we must fail.
+    if (!expected_public_keys.empty() &&
+        parsed_headers->signatures.size() > 0 &&
+        (!response.unencoded_digests ||
+         response.unencoded_digests->digests.empty())) {
+      return mojom::BlockedByResponseReason::kSRIMessageSignatureMismatch;
+    }
     return std::nullopt;
   }
   return mojom::BlockedByResponseReason::kSRIMessageSignatureMismatch;
diff --git a/services/network/public/cpp/sri_message_signatures_unittest.cc b/services/network/public/cpp/sri_message_signatures_unittest.cc
index b4b66a29..0539caa 100644
--- a/services/network/public/cpp/sri_message_signatures_unittest.cc
+++ b/services/network/public/cpp/sri_message_signatures_unittest.cc
@@ -21,6 +21,7 @@
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/unencoded_digests.h"
 #include "services/network/public/mojom/sri_message_signature.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -1634,6 +1635,7 @@
                                          std::string_view input) {
     auto head = mojom::URLResponseHead::New();
     head->headers = Headers(digest, signature, input);
+    head->unencoded_digests = ParseUnencodedDigestsFromHeaders(*head->headers);
     return head;
   }
 };
@@ -1698,6 +1700,26 @@
             result.value());
 }
 
+TEST_F(SRIMessageSignatureEnforcementTest,
+       ValidHeadersButEmptyUnencodedDigestsFailOpen) {
+  const std::vector<uint8_t> public_key = *base::Base64Decode(kPublicKey);
+
+  auto head = ResponseHead(kValidDigestHeader, kValidSignatureHeader,
+                           kValidSignatureInputHeader);
+
+  // Manually clear the digests to simulate a header that was present but
+  // didn't contain any supported algorithms.
+  head->unencoded_digests->digests.clear();
+
+  auto result =
+      MaybeBlockResponseForSRIMessageSignature(request(), *head, {public_key});
+
+  // This should now be blocked.
+  EXPECT_TRUE(result.has_value());
+  EXPECT_EQ(mojom::BlockedByResponseReason::kSRIMessageSignatureMismatch,
+            result.value());
+}
+
 TEST_F(SRIMessageSignatureEnforcementTest, MismatchedHeaders) {
   const char* wrong_key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   const char* wrong_signature =
diff --git a/third_party/blink/renderer/platform/loader/subresource_integrity.cc b/third_party/blink/renderer/platform/loader/subresource_integrity.cc
index 7b6226c..e8443b2 100644
--- a/third_party/blink/renderer/platform/loader/subresource_integrity.cc
+++ b/third_party/blink/renderer/platform/loader/subresource_integrity.cc
@@ -9,6 +9,7 @@
 #include "base/strings/string_view_util.h"
 #include "services/network/public/mojom/fetch_api.mojom-blink.h"
 #include "services/network/public/mojom/sri_message_signature.mojom-blink.h"
+#include "services/network/public/mojom/unencoded_digest.mojom-blink.h"
 #include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom-blink.h"
 #include "third_party/blink/public/platform/web_crypto.h"
 #include "third_party/blink/public/platform/web_crypto_algorithm.h"
@@ -361,6 +362,22 @@
   Vector<network::mojom::blink::SRIMessageSignaturePtr> signatures =
       std::move(ParseSRIMessageSignaturesFromHeaders(raw_headers)->signatures);
 
+  // Any SRI signature MUST cover `unencoded-digest`. If we have signatures,
+  // but we don't have any usable `unencoded-digest` assertions, we must fail.
+  if (!signatures.empty()) {
+    network::mojom::blink::UnencodedDigestsPtr unencoded_digests =
+        ParseUnencodedDigestsFromHeaders(raw_headers);
+    if (unencoded_digests->digests.empty()) {
+      integrity_report.AddConsoleErrorMessage(
+          StrCat({"Subresource Integrity: The resource at `",
+                  resource_url.ElidedString(),
+                  "` was signed, but did not provide any supported "
+                  "`unencoded-digest` assertions. The resource has been "
+                  "blocked."}));
+      return false;
+    }
+  }
+
   // This would be caught below, but we'll exit early for unsigned resources
   // so we can provide a better error message in the console.
   if (signatures.empty() && !integrity_list.empty()) {
diff --git a/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc b/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
index f60ffef..2677266 100644
--- a/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
+++ b/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
@@ -890,6 +890,42 @@
       << "Resource variant";
 }
 
+TEST_P(SubresourceIntegritySignatureTest,
+       CheckValidSignatureButEmptyUnencodedDigest) {
+  // Known-good message signature constants:
+  String kPublicKey = "JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
+  // Use an unsupported algorithm (sha-384).
+  String kUnsupportedDigestHeader =
+      "sha-384=:uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=:";
+  String kValidSignatureInputHeader =
+      "signature=(\"unencoded-digest\";sf);"
+      "keyid=\"JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=\";tag=\"sri\"";
+  String kValidSignatureHeader =
+      "signature=:gHim9e5Pk2H7c9BStOmxSmkyc8+ioZgoxynu3d4INAT4dwfj5LhvaV9DFnEQ9"
+      "p7C0hzW4o4Qpkm5aApd6WLLCw==:";
+
+  String raw_headers =
+      "HTTP/1.1 200 OK\r\n"
+      "Unencoded-Digest: " +
+      kUnsupportedDigestHeader +
+      "\r\n"
+      "Signature-Input: " +
+      kValidSignatureInputHeader +
+      "\r\n"
+      "Signature: " +
+      kValidSignatureHeader + "\r\n\r\n";
+
+  IntegrityReport integrity_report;
+  IntegrityMetadataSet metadata_set;
+  metadata_set.public_keys = {
+      CreateIntegrityMetadata(kPublicKey, IntegrityAlgorithm::kEd25519)};
+
+  // This should now FAIL because unencoded-digest algorithm is unsupported.
+  EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(
+      metadata_set, /*buffer=*/nullptr, sec_url, FetchResponseType::kCors,
+      raw_headers, /*feature_context=*/nullptr, integrity_report));
+}
+
 TEST_P(SubresourceIntegritySignatureTest, Inline_NoSignatures) {
   String kIntegrity = "ed25519-JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
   String kSource = "alert(1);";
diff --git a/third_party/blink/renderer/platform/network/http_parsers.cc b/third_party/blink/renderer/platform/network/http_parsers.cc
index 75a0133..d0b1b02 100644
--- a/third_party/blink/renderer/platform/network/http_parsers.cc
+++ b/third_party/blink/renderer/platform/network/http_parsers.cc
@@ -52,6 +52,7 @@
 #include "services/network/public/cpp/parsed_headers.h"
 #include "services/network/public/cpp/sri_message_signatures.h"
 #include "services/network/public/cpp/timing_allow_origin_parser.h"
+#include "services/network/public/cpp/unencoded_digests.h"
 #include "services/network/public/mojom/connection_allowlist.mojom-blink.h"
 #include "services/network/public/mojom/integrity_policy.mojom-blink.h"
 #include "services/network/public/mojom/no_vary_search.mojom-blink-forward.h"
@@ -60,6 +61,7 @@
 #include "services/network/public/mojom/sri_message_signature.mojom-blink.h"
 #include "services/network/public/mojom/supports_loading_mode.mojom-blink.h"
 #include "services/network/public/mojom/timing_allow_origin.mojom-blink.h"
+#include "services/network/public/mojom/unencoded_digest.mojom-blink.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_response.h"
@@ -115,6 +117,10 @@
   return static_cast<blink::LoadingMode>(in);
 }
 
+blink::UnencodedDigestIssue ConvertToBlink(UnencodedDigestIssue in) {
+  return in;
+}
+

diff --git a/services/network/public/cpp/sri_message_signatures_unittest.cc b/services/network/public/cpp/sri_message_signatures_unittest.cc
index b4b66a29..0539caa 100644
--- a/services/network/public/cpp/sri_message_signatures_unittest.cc
+++ b/services/network/public/cpp/sri_message_signatures_unittest.cc
@@ -21,6 +21,7 @@
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/unencoded_digests.h"
 #include "services/network/public/mojom/sri_message_signature.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -1634,6 +1635,7 @@
                                          std::string_view input) {
     auto head = mojom::URLResponseHead::New();
     head->headers = Headers(digest, signature, input);
+    head->unencoded_digests = ParseUnencodedDigestsFromHeaders(*head->headers);
     return head;
   }
 };
@@ -1698,6 +1700,26 @@
             result.value());
 }
 
+TEST_F(SRIMessageSignatureEnforcementTest,
+       ValidHeadersButEmptyUnencodedDigestsFailOpen) {
+  const std::vector<uint8_t> public_key = *base::Base64Decode(kPublicKey);
+
+  auto head = ResponseHead(kValidDigestHeader, kValidSignatureHeader,
+                           kValidSignatureInputHeader);
+
+  // Manually clear the digests to simulate a header that was present but
+  // didn't contain any supported algorithms.
+  head->unencoded_digests->digests.clear();
+
+  auto result =
+      MaybeBlockResponseForSRIMessageSignature(request(), *head, {public_key});
+
+  // This should now be blocked.
+  EXPECT_TRUE(result.has_value());
+  EXPECT_EQ(mojom::BlockedByResponseReason::kSRIMessageSignatureMismatch,
+            result.value());
+}
+
 TEST_F(SRIMessageSignatureEnforcementTest, MismatchedHeaders) {
   const char* wrong_key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   const char* wrong_signature =
diff --git a/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc b/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
index f60ffef..2677266 100644
--- a/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
+++ b/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc
@@ -890,6 +890,42 @@
       << "Resource variant";
 }
 
+TEST_P(SubresourceIntegritySignatureTest,
+       CheckValidSignatureButEmptyUnencodedDigest) {
+  // Known-good message signature constants:
+  String kPublicKey = "JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
+  // Use an unsupported algorithm (sha-384).
+  String kUnsupportedDigestHeader =
+      "sha-384=:uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=:";
+  String kValidSignatureInputHeader =
+      "signature=(\"unencoded-digest\";sf);"
+      "keyid=\"JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=\";tag=\"sri\"";
+  String kValidSignatureHeader =
+      "signature=:gHim9e5Pk2H7c9BStOmxSmkyc8+ioZgoxynu3d4INAT4dwfj5LhvaV9DFnEQ9"
+      "p7C0hzW4o4Qpkm5aApd6WLLCw==:";
+
+  String raw_headers =
+      "HTTP/1.1 200 OK\r\n"
+      "Unencoded-Digest: " +
+      kUnsupportedDigestHeader +
+      "\r\n"
+      "Signature-Input: " +
+      kValidSignatureInputHeader +
+      "\r\n"
+      "Signature: " +
+      kValidSignatureHeader + "\r\n\r\n";
+
+  IntegrityReport integrity_report;
+  IntegrityMetadataSet metadata_set;
+  metadata_set.public_keys = {
+      CreateIntegrityMetadata(kPublicKey, IntegrityAlgorithm::kEd25519)};
+
+  // This should now FAIL because unencoded-digest algorithm is unsupported.
+  EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(
+      metadata_set, /*buffer=*/nullptr, sec_url, FetchResponseType::kCors,
+      raw_headers, /*feature_context=*/nullptr, integrity_report));
+}
+
 TEST_P(SubresourceIntegritySignatureTest, Inline_NoSignatures) {
   String kIntegrity = "ed25519-JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
   String kSource = "alert(1);";
diff --git a/third_party/blink/web_tests/external/wpt/subresource-integrity/integrity-policy/tentative/signature.https.html b/third_party/blink/web_tests/external/wpt/subresource-integrity/integrity-policy/tentative/signature.https.html
index d54a6df..cc15beb 100644
--- a/third_party/blink/web_tests/external/wpt/subresource-integrity/integrity-policy/tentative/signature.https.html
+++ b/third_party/blink/web_tests/external/wpt/subresource-integrity/integrity-policy/tentative/signature.https.html
@@ -8,11 +8,19 @@
 <body>
 <script>
   promise_test(async () => {
-    // Generated using https://sha2.it/ed25519.html in a browser that supports Signature-Based SRI (e.g. Chrome 136+, with Experimental Web Platform Features enabled)
+    // Generated using https://sha2.it/ed25519.html in a browser that supports Signature-Based SRI
+    //
+    // The response over which the digest is generated is `window.ran = true;\n`, and the "signature
+    // base" is:
+    //
+    // ```
+    // "unencoded-digest";sf: sha-256=:JWql9hchAH1Rc/vo5mdgD2Tw1oSH1HlByNgKGDxSh9Y=:
+    // "@signature-params": ("unencoded-digest";sf);keyid="JrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";tag="ed25519-integrity"
+    // ```
     const signature = encodeURIComponent(
-      'header(Unencoded-Digest, sha-384=:tqyFpeo21WFM8HDeUtLqH20GUq\/q3D1R6mqTzW3RtyTZ3dAYZJhC1wUcnkgOE2ak:)' +
-      '|header(Signature-Input, signature=\\("unencoded-digest";sf\\); keyid="JrQLj5P\/89iXES9+vFgrIy29clF9CC\/oPPsw3c5D0bs="; tag="sri")' +
-      '|header(Signature, signature=:qM19uLskHm2TQG5LJcH/hY0n0BWWzYOJztVWYlwk0cZb3u0JdgUMre1J4Jn8Tma0x2u5/kPBfbXRMbB+X+vTBw==:)');
+      'header(Unencoded-Digest, sha-256=:JWql9hchAH1Rc/vo5mdgD2Tw1oSH1HlByNgKGDxSh9Y=:)' +
+      '|header(Signature-Input, signature=\\("unencoded-digest";sf\\); keyid="JrQLj5P\/89iXES9+vFgrIy29clF9CC\/oPPsw3c5D0bs="; tag="ed25519-integrity")' +
+      '|header(Signature, signature=:wst4wjY8b6fzAKf0bnxEHjbZnUnOB9v9DqXLZBFKiogHlLzEe2mELvhFAzCZrtKSy3gO5jRv6NzaLTUcYQWXAA==:)');
 
     const REMOTE_EXECUTOR =
       `/common/dispatcher/remote-executor.html`;