Upstream Trusted Types enforcement in EnsureCSPDoesNotBlockStringCompilation #659
Conversation
…ilation - Also update the violation object resource definition.
|
@annevk just so I'm not putting all this spec stuff on your plate, do you know who else might be able to review this? |
https://bugs.webkit.org/show_bug.cgi?id=275392 Reviewed by NOBODY (OOPS!). This patch accurately follows the spec for sample clipping in trusted types. Spec: w3c/webappsec-csp#659 * LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-clips-sample.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-clips-sample.https.html: * Source/WebCore/page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::didReceiveHeader): (WebCore::ContentSecurityPolicy::allowMissingTrustedTypesForSinkGroup const): (WebCore::ContentSecurityPolicy::reportViolation const): (WebCore::ContentSecurityPolicy::setUpgradeInsecureRequests): * Source/WebCore/page/csp/ContentSecurityPolicy.h:
|
I'll take a look tomorrow. 👍 |
index.bs
Outdated
|
|
||
| 1. For each |arg| in |parameterArgs|: | ||
|
|
||
| 1. Let |index| be the index of |arg| in |parameterArgs|. |
There was a problem hiding this comment.
I'd suggest writing this loop differently, as I don't think Infra provides a way to get the index of a given element in a list. Something like the following:
1. Assert: |parameterArgs|' [list/length=] is equal to [parameterStrings]' [=list/length=].
1. [=list/iterate|For each=] |index| of [=the range=] 0 to |parameterArgs|' [=list/length=]:
1. Let |arg| be |parameterArgs|[|index|].
Alternatively, we could add something to Infra to either create a For each variant that provides both an item and its index, or some mechanism to get the index of a given item? @annevk might have thoughts about which path might be preferable.
There was a problem hiding this comment.
I've gone with what you suggested for now.
|
This should be ready to merge @mikewest (I have permissions but don't know if there's any specific commit message changes you'd like to make) |
|
Nope. In that case, still still LGTM. Feel free to merge it. :) |
Updates EnsureCSPDoesNotBlockStringCompilation to upstream changes from the Trusted Types spec. For non timers this now goes through the motions of checking CSP for trusted types and doing neccessary enforcement.
unsafe-eval is left as is.
Preview | Diff