Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-09-30 08:39:16 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix reporting when only the report-only CSP header is present (#38002)

Browse source 
This was a bit confusing at first, but the report-only only
had an effect if it was used in conjunction with the regular
CSP header. This is incorrect, as the report-only header
can be present on its own.

Additionally, there was double-logic for parsing the CSP list
values, since we can only concatenate CSP lists if we have
an initial value, which requires a concrete policy value.

Therefore, abstract that way by looping over both headers and
handling the case where initially it is `None` and, if the
CSP header is not present, still `None` when we parse
the `report-only` header.

Additionally, update a WPT test. It was expecting the image
to load, yet was showing the fail image.

Part of #4577

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
This commit is contained in:
Tim van der Lippe 2025-07-12 12:38:30 +02:00 • committed by GitHub
parent 9b5b26386c
commit 2c116f4011
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
15 changed files with 48 additions and 124 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/wpt/meta/content-security-policy/inside-worker/dedicatedworker-report-only.html.ini vendored
View file

@ -1,16 +1,7 @@
[dedicatedworker-report-only.html]
expected: TIMEOUT
[Cross-origin 'fetch()'.]
expected: TIMEOUT
[Cross-origin XHR.]
expected: NOTRUN
[Same-origin => cross-origin 'fetch()'.]
expected: NOTRUN
[WebSocket.]
expected: NOTRUN
expected: TIMEOUT
[connect-src-self-report-only]
expected: NOTRUN