Implement basics of link preloading (#37036)

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of #4577
Part of #35035

---------

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
This commit is contained in:
Tim van der Lippe 2025-05-29 13:26:27 +02:00 committed by GitHub
parent 9dc1391bef
commit 36e4886da1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
174 changed files with 2814 additions and 1097 deletions

View file

@ -0,0 +1,69 @@
[subresource-integrity-font.html]
[<crossorigin="anonymous"> Same-origin with correct sha256 hash.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with correct sha384 hash.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with correct sha512 hash.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with empty integrity.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with no integrity.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with incorrect hash.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with correct sha256 hash, options.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with unknown algorithm only.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with multiple sha256 hashes, including correct.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with multiple sha256 hashes, including unknown algorithm.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with sha256 mismatch, sha512 match.]
expected: FAIL
[<crossorigin="anonymous"> Same-origin with sha256 match, sha512 mismatch.]
expected: FAIL
[Same-origin, not CORS request, with correct sha256 hash.]
expected: FAIL
[Same-origin, not CORS request, with incorrect sha256 hash.]
expected: FAIL
[<crossorigin="anonymous"> Cross-origin with correct sha256 hash, ACAO: *.]
expected: FAIL
[<crossorigin="anonymous"> Cross-origin with incorrect sha256 hash, ACAO: *.]
expected: FAIL
[<crossorigin="anonymous"> Cross-origin with correct sha256 hash, with CORS-ineligible resource.]
expected: FAIL
[Cross-origin, not CORS request, with correct sha256.]
expected: FAIL
[Cross-origin, not CORS request, with incorrect sha256.]
expected: FAIL
[<crossorigin="anonymous"> Cross-origin with empty integrity.]
expected: FAIL
[Cross-origin, not CORS request, with empty integrity.]
expected: FAIL
[<crossorigin="use-credentials"> Cross-origin with correct sha256 hash, CORS-eligible.]
expected: FAIL
[<crossorigin="use-credentials"> Cross-origin with incorrect sha256 hash, CORS-eligible.]
expected: FAIL