⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 286763 in webkit


Ignore:
Timestamp:
Dec 8, 2021, 10:34:52 PM (5 years ago)
Author:
Patrick Griffis
Message:

CSP: Skip whitespace at beginning of policy header
​https://bugs.webkit.org/show_bug.cgi?id=233951

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Update expectations as passing.

  • web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub-expected.txt:

Source/WebCore:

This should have no practical effect but it fixes matching
the originalPolicy property in WPT results.

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::didReceiveHeader):

LayoutTests:

No longer skip a test and update results to not have leading whitespace.

  • TestExpectations:
  • http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r286758 r286763  
     12021-12-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Skip whitespace at beginning of policy header
     4        https://bugs.webkit.org/show_bug.cgi?id=233951
     5
     6        Reviewed by Kate Cheney.
     7
     8        No longer skip a test and update results to not have leading whitespace.
     9
     10        * TestExpectations:
     11        * http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
     12
    1132021-12-08  Arcady Goldmints-Orlov  <agoldmints@igalia.com>
    214

  • trunk/LayoutTests/TestExpectations

    r286672 r286763  
    981981imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-cross-origin-load.sub.html [ Skip ]
    982982imported/w3c/web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub.html [ Skip ]
    983 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub.html [ Skip ]
    984983imported/w3c/web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-href_blank.html [ Skip ]
    985984

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt

    r286363 r286763  
    3838REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.py?test=script-blocked-sends-multiple-reports-enforced-2
    3939=== POST DATA ===
    40 {"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports.py","referrer":"","violated-directive":"script-src-elem","effective-directive":"script-src","original-policy":" script-src http://127.0.0.1:8000 https://127.0.0.1:8443 'unsafe-inline'; report-uri ../resources/save-report.py?test=script-blocked-sends-multiple-reports-enforced-2","blocked-uri":"http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js","status-code":200}}
     40{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports.py","referrer":"","violated-directive":"script-src-elem","effective-directive":"script-src","original-policy":"script-src http://127.0.0.1:8000 https://127.0.0.1:8443 'unsafe-inline'; report-uri ../resources/save-report.py?test=script-blocked-sends-multiple-reports-enforced-2","blocked-uri":"http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js","status-code":200}}

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r286668 r286763  
     12021-12-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Skip whitespace at beginning of policy header
     4        https://bugs.webkit.org/show_bug.cgi?id=233951
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update expectations as passing.
     9
     10        * web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub-expected.txt:
     11
    1122021-12-08  Antti Koivisto  <antti@apple.com>
    213

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub-expected.txt

    r283192 r286763  
    22
    33
    4 Harness Error (TIMEOUT), message = null
     4PASS Script injected via `appendChild` is permitted with `strict-dynamic` + a nonce+allowed double policy.
     5PASS Non-allowed script injected via `appendChild` is not permitted with `strict-dynamic` + a nonce+allowed double policy.
    56
    6 PASS Script injected via `appendChild` is permitted with `strict-dynamic` + a nonce+allowed double policy.
    7 TIMEOUT Non-allowed script injected via `appendChild` is not permitted with `strict-dynamic` + a nonce+allowed double policy. Test timed out
    8 

  • trunk/Source/WebCore/ChangeLog

    r286762 r286763  
     12021-12-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Skip whitespace at beginning of policy header
     4        https://bugs.webkit.org/show_bug.cgi?id=233951
     5
     6        Reviewed by Kate Cheney.
     7
     8        This should have no practical effect but it fixes matching
     9        the originalPolicy property in WPT results.
     10
     11        * page/csp/ContentSecurityPolicy.cpp:
     12        (WebCore::ContentSecurityPolicy::didReceiveHeader):
     13
    1142021-12-08  Megan Gardner  <megan_gardner@apple.com>
    215

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286363 r286763  
    205205    // separated chunk as a separate header.
    206206    readCharactersForParsing(header, [&](auto buffer) {
     207        skipWhile<isASCIISpace>(buffer);
    207208        auto begin = buffer.position();
    208    
     209
    209210        while (buffer.hasCharactersRemaining()) {
    210211            skipUntil(buffer, ',');
Note: See TracChangeset for help on using the changeset viewer.