#!/usr/bin/env python3 """ POC server: Signature-based SRI fail-open when Unencoded-Digest uses an unrecognized algorithm. All Ed25519 material below is precomputed (RFC 8032 test vector #1 private key) so this server has no third-party dependencies. Endpoints --------- / index page that loads three """ class Handler(http.server.BaseHTTPRequestHandler): protocol_version = "HTTP/1.1" def _script(self, digest, sig, tag): body = body_for(tag) self.send_response(200) self.send_header("Content-Type", "application/javascript") self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Cache-Control", "no-store") self.send_header("Unencoded-Digest", digest) self.send_header("Signature-Input", SIG_INPUT) self.send_header("Signature", sig) self.send_header("Content-Length", str(len(body))) self.end_headers() try: self.wfile.write(body) except BrokenPipeError: # Chrome may abort the connection after deciding to block the # response in the network service; ignore. pass def do_GET(self): if self.path == "/" or self.path == "/index.html": body = INDEX.encode() self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Cache-Control", "no-store") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) elif self.path == "/bug.js": self._script(DIGEST_BUG, SIG_BUG, "bug") elif self.path == "/control-block.js": self._script(DIGEST_CTRL_BLOCK, SIG_CTRL_BLOCK, "control-block") elif self.path == "/control-pass.js": self._script(DIGEST_CTRL_PASS, SIG_CTRL_PASS, "control-pass") elif self.path.startswith("/report"): sys.stderr.write(f"**** SCRIPT EXECUTED: {self.path} ****\n") self.send_response(204) self.send_header("Content-Length", "0") self.end_headers() else: self.send_error(404) def log_message(self, fmt, *args): sys.stderr.write("[server] " + (fmt % args) + "\n") class ThreadingHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer): allow_reuse_address = True daemon_threads = True if __name__ == "__main__": with ThreadingHTTPServer(("127.0.0.1", PORT), Handler) as httpd: sys.stderr.write(f"[server] listening on http://127.0.0.1:{PORT}/\n") httpd.serve_forever()