Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-06 22:15:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Implement CSP check for Trusted Types (#36363)

Browse source 
The algorithm [1] is implemented in the content-security-policy
package.

Requires
https://github.com/rust-ammonia/rust-content-security-policy/pull/56
This is part of #36258

[1]:
https://w3c.github.io/trusted-types/dist/spec/#abstract-opdef-should-trusted-type-policy-creation-be-blocked-by-content-security-policy

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
Co-authored-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Tim van der Lippe 2025-04-14 18:44:50 +02:00 • committed by GitHub
parent d46a17a487
commit 4e1ea81992
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 14 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

15
components/script/dom/trustedtypepolicyfactory.rs
View file

@ -3,6 +3,7 @@
* file, You can obtain one at https://mozilla.org/MPL/2.0/. */
use std::cell::RefCell;
use content_security_policy::CheckResult;
use dom_struct::dom_struct;
use html5ever::{LocalName, Namespace, QualName, local_name, namespace_url, ns};
use js::rust::HandleValue;
@ -52,13 +53,21 @@ impl TrustedTypePolicyFactory {
global: &GlobalScope,
can_gc: CanGc,
) -> Fallible<DomRoot<TrustedTypePolicy>> {
// TODO(36258): implement proper CSP check
// Step 1: Let allowedByCSP be the result of executing Should Trusted Type policy creation be blocked by
// Content Security Policy? algorithm with global, policyName and factory’s created policy names value.
let allowed_by_csp = true;
let (allowed_by_csp, violations) = if let Some(csp_list) = global.get_csp_list() {
csp_list.is_trusted_type_policy_creation_allowed(
policy_name.clone(),
self.policy_names.borrow().clone(),
)
} else {
(CheckResult::Allowed, Vec::new())
};
global.report_csp_violations(violations);
// Step 2: If allowedByCSP is "Blocked", throw a TypeError and abort further steps.
if !allowed_by_csp {
if allowed_by_csp == CheckResult::Blocked {
return Err(Error::Type("Not allowed by CSP".to_string()));
}