diff --git a/components/script/dom/document.rs b/components/script/dom/document.rs index b775bdd4582..0d39a12c15e 100644 --- a/components/script/dom/document.rs +++ b/components/script/dom/document.rs @@ -4017,13 +4017,18 @@ impl Document { .get_attribute(&ns!(), &local_name!("nonce")) .map(|attr| Cow::Owned(attr.value().to_string())), }; - // TODO: Instead of ignoring violations, report them. - self.get_csp_list() - .map(|c| { - c.should_elements_inline_type_behavior_be_blocked(&element, type_, source) - .0 - }) - .unwrap_or(csp::CheckResult::Allowed) + let (result, violations) = match self.get_csp_list() { + None => { + return csp::CheckResult::Allowed; + }, + Some(csp_list) => { + csp_list.should_elements_inline_type_behavior_be_blocked(&element, type_, source) + }, + }; + + self.global().report_csp_violations(violations); + + result } /// Prevent any JS or layout from running until the corresponding call to diff --git a/components/script/dom/eventtarget.rs b/components/script/dom/eventtarget.rs index ea76bbf2a8b..1a5aafb0ae7 100644 --- a/components/script/dom/eventtarget.rs +++ b/components/script/dom/eventtarget.rs @@ -11,6 +11,7 @@ use std::mem; use std::ops::{Deref, DerefMut}; use std::rc::Rc; +use content_security_policy as csp; use deny_public_fields::DenyPublicFields; use dom_struct::dom_struct; use fnv::FnvHasher; @@ -551,9 +552,25 @@ impl EventTarget { url: ServoUrl, line: usize, ty: &str, - source: DOMString, + source: &str, ) { - let handler = InternalRawUncompiledHandler { source, line, url }; + if let Some(element) = self.downcast::() { + let doc = element.owner_document(); + if doc.should_elements_inline_type_behavior_be_blocked( + element.upcast(), + csp::InlineCheckType::ScriptAttribute, + source, + ) == csp::CheckResult::Blocked + { + return; + } + }; + + let handler = InternalRawUncompiledHandler { + source: DOMString::from(source), + line, + url, + }; self.set_inline_event_listener( Atom::from(ty), Some(InlineEventListener::Uncompiled(handler)), diff --git a/components/script/dom/globalscope.rs b/components/script/dom/globalscope.rs index e56f4693e35..2582291ed87 100644 --- a/components/script/dom/globalscope.rs +++ b/components/script/dom/globalscope.rs @@ -3450,12 +3450,15 @@ impl GlobalScope { pub(crate) fn report_csp_violations(&self, violations: Vec) { for violation in violations { - let sample = match violation.resource { - ViolationResource::Inline { .. } | ViolationResource::Url(_) => None, - ViolationResource::TrustedTypePolicy { sample } => Some(sample), + let (sample, resource) = match violation.resource { + ViolationResource::Inline { .. } => (None, "inline".to_owned()), + ViolationResource::Url(url) => (None, url.into()), + ViolationResource::TrustedTypePolicy { sample } => { + (Some(sample), "trusted-types-policy".to_owned()) + }, }; let report = CSPViolationReportBuilder::default() - .resource("eval".to_owned()) + .resource(resource) .sample(sample) .effective_directive(violation.directive.name) .build(self); diff --git a/components/script/dom/htmlbodyelement.rs b/components/script/dom/htmlbodyelement.rs index ba3316f889b..5cd877cdf82 100644 --- a/components/script/dom/htmlbodyelement.rs +++ b/components/script/dom/htmlbodyelement.rs @@ -201,13 +201,14 @@ impl VirtualMethods for HTMLBodyElement { &local_name!("onresize") | &local_name!("onunload") | &local_name!("onerror") => { + let source = &**attr.value(); let evtarget = window.upcast::(); // forwarded event let source_line = 1; //TODO(#9604) obtain current JS execution line evtarget.set_event_handler_uncompiled( window.get_url(), source_line, &name[2..], - DOMString::from((**attr.value()).to_owned()), + source, ); false }, diff --git a/components/script/dom/htmlelement.rs b/components/script/dom/htmlelement.rs index 14c85603740..0cdfebf5342 100644 --- a/components/script/dom/htmlelement.rs +++ b/components/script/dom/htmlelement.rs @@ -1084,14 +1084,14 @@ impl VirtualMethods for HTMLElement { let element = self.as_element(); match (attr.local_name(), mutation) { (name, AttributeMutation::Set(_)) if name.starts_with("on") => { + let source = &**attr.value(); let evtarget = self.upcast::(); let source_line = 1; //TODO(#9604) get current JS execution line evtarget.set_event_handler_uncompiled( self.owner_window().get_url(), source_line, &name[2..], - // FIXME(ajeffrey): Convert directly from AttrValue to DOMString - DOMString::from(&**attr.value()), + source, ); }, (&local_name!("form"), mutation) if self.is_form_associated_custom_element() => { diff --git a/tests/wpt/include.ini b/tests/wpt/include.ini index 6cafe653196..fdbd71b9ee6 100644 --- a/tests/wpt/include.ini +++ b/tests/wpt/include.ini @@ -13,6 +13,8 @@ skip: true skip: true [content-security-policy] skip: false + [embedded-enforcement] + skip: true [cors] skip: false [css] diff --git a/tests/wpt/meta/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub.html.ini b/tests/wpt/meta/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub.html.ini index efaa0fc8ca4..e3d7c23eef2 100644 --- a/tests/wpt/meta/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub.html.ini +++ b/tests/wpt/meta/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub.html.ini @@ -1,6 +1,3 @@ [report-uri-does-not-respect-base-uri.sub.html] - [Event is fired] - expected: FAIL - [Violation report status OK.] expected: FAIL diff --git a/tests/wpt/meta/content-security-policy/default-src/default-src-inline-blocked.sub.html.ini b/tests/wpt/meta/content-security-policy/default-src/default-src-inline-blocked.sub.html.ini deleted file mode 100644 index c2b9c5f26c7..00000000000 --- a/tests/wpt/meta/content-security-policy/default-src/default-src-inline-blocked.sub.html.ini +++ /dev/null @@ -1,3 +0,0 @@ -[default-src-inline-blocked.sub.html] - [Expecting logs: ["violated-directive=script-src-elem","violated-directive=script-src-elem"\]] - expected: FAIL diff --git a/tests/wpt/meta/content-security-policy/default-src/default-src-strict_dynamic_and_unsafe_inline.html.ini b/tests/wpt/meta/content-security-policy/default-src/default-src-strict_dynamic_and_unsafe_inline.html.ini deleted file mode 100644 index e1b9ec3f770..00000000000 --- a/tests/wpt/meta/content-security-policy/default-src/default-src-strict_dynamic_and_unsafe_inline.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[default-src-strict_dynamic_and_unsafe_inline.html] - expected: TIMEOUT - [Should fire a security policy violation for the inline block] - expected: NOTRUN diff --git a/tests/wpt/meta/content-security-policy/embedded-enforcement/allow_csp_from-header.html.ini b/tests/wpt/meta/content-security-policy/embedded-enforcement/allow_csp_from-header.html.ini deleted file mode 100644 index 3cf8d56a5d6..00000000000 --- a/tests/wpt/meta/content-security-policy/embedded-enforcement/allow_csp_from-header.html.ini +++ /dev/null @@ -1,25 +0,0 @@ -[allow_csp_from-header.html] - expected: TIMEOUT - [Same origin iframes with an empty Allow-CSP-From header get blocked.] - expected: FAIL - - [Same origin iframes without Allow-CSP-From header gets blocked.] - expected: FAIL - - [Same origin iframes are blocked if Allow-CSP-From does not match origin.] - expected: FAIL - - [Cross origin iframe with an empty Allow-CSP-From header gets blocked.] - expected: FAIL - - [Cross origin iframe without Allow-CSP-From header gets blocked.] - expected: FAIL - - [Iframe with improper Allow-CSP-From header gets blocked.] - expected: FAIL - - [Star Allow-CSP-From header enforces EmbeddingCSP.] - expected: TIMEOUT - - [Allow-CSP-From header enforces EmbeddingCSP.] - expected: TIMEOUT diff --git a/tests/wpt/meta/content-security-policy/embedded-enforcement/blocked-iframe-are-cross-origin.html.ini b/tests/wpt/meta/content-security-policy/embedded-enforcement/blocked-iframe-are-cross-origin.html.ini deleted file mode 100644 index 31c147a6ece..00000000000 --- a/tests/wpt/meta/content-security-policy/embedded-enforcement/blocked-iframe-are-cross-origin.html.ini +++ /dev/null @@ -1,6 +0,0 @@ -[blocked-iframe-are-cross-origin.html] - [Document blocked by embedded enforcement and its parent are cross-origin] - expected: FAIL - - [Two same-origin iframes must appear as cross-origin when one is blocked] - expected: FAIL diff --git a/tests/wpt/meta/content-security-policy/embedded-enforcement/change-csp-attribute-and-history-navigation.html.ini b/tests/wpt/meta/content-security-policy/embedded-enforcement/change-csp-attribute-and-history-navigation.html.ini deleted file mode 100644 index c8205878128..00000000000 --- a/tests/wpt/meta/content-security-policy/embedded-enforcement/change-csp-attribute-and-history-navigation.html.ini +++ /dev/null @@ -1,6 +0,0 @@ -[change-csp-attribute-and-history-navigation.html] - [Iframe csp attribute changed before history navigation of local scheme.] - expected: FAIL - - [Iframe csp attribute changed before history navigation of network scheme.] - expected: FAIL diff --git a/tests/wpt/meta/content-security-policy/embedded-enforcement/idlharness.window.js.ini b/tests/wpt/meta/content-security-policy/embedded-enforcement/idlharness.window.js.ini deleted file mode 100644 index 551c76a0058..00000000000 --- a/tests/wpt/meta/content-security-policy/embedded-enforcement/idlharness.window.js.ini +++ /dev/null @@ -1,6 +0,0 @@ -[idlharness.window.html] - [HTMLIFrameElement interface: attribute csp] - expected: FAIL - - [HTMLIFrameElement interface: document.createElement("iframe") must inherit property "csp" with the proper type] - expected: FAIL diff --git a/tests/wpt/meta/content-security-policy/embedded-enforcement/iframe-csp-attribute.html.ini b/tests/wpt/meta/content-security-policy/embedded-enforcement/iframe-csp-attribute.html.ini deleted file mode 100644 index 000df37abc1..00000000000 --- a/tests/wpt/meta/content-security-policy/embedded-enforcement/iframe-csp-attribute.html.ini +++ /dev/null @@ -1,12 +0,0 @@ -[iframe-csp-attribute.html] - [