Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-09-29 16:19:14 +01:00
Code Issues Projects Releases Packages Wiki Activity

Implement trusted types processing for JavaScript URL (#38623)

Browse source 
We pass in the new trait implementation to process the value,
which the CSP crate calls in its implementation. Additionally,
since the request url can change, we need to propagate that
to load_data as well.

This also avoids a crash when a discarded browsing context is
accessed while navigating the iframes in the WPT tests. This
is a known issue, but hampers investigation into actual
Trusted Types support.

All tests using iframes don't work, as they don't have the
correct browsing context. The other tests do work, but some
fail on header ascii parsing (#36801) or error while handling
errors. That last one I don't understand based on the current
code and I would need to do a deep-dive in the existing code
to understand better what's going on.

Part of #36258
Part of #37920

---------

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
This commit is contained in:
Tim van der Lippe 2025-08-27 23:53:18 +02:00 • committed by GitHub
parent c4bd955a69
commit 84f478a47a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 66 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/wpt/meta/trusted-types/navigate-to-javascript-url-002.html.ini vendored
View file

@ -1,3 +0,0 @@
[navigate-to-javascript-url-002.html]
[Setting window.location to a javascript: URL with a default policy should execute the JavaScript code modified by that policy.]
expected: FAIL

1
tests/wpt/meta/trusted-types/navigate-to-javascript-url-003.html.ini vendored
View file

@ -1,3 +1,4 @@
[navigate-to-javascript-url-003.html]
expected: ERROR
[Setting window.location to a javascript: URL with a default policy that throws should report a CSP violation without rethrowing the exception.]
expected: FAIL

3
tests/wpt/meta/trusted-types/navigate-to-javascript-url-005.html.ini vendored
View file

@ -1,3 +0,0 @@
[navigate-to-javascript-url-005.html]
[A subframe navigating to a javascript: URL should use the CSP policy associated to its document for pre-navigation check and report a violation when it does not defined a default policy.]
expected: FAIL

3
tests/wpt/meta/trusted-types/navigate-to-javascript-url-006.sub.html.ini vendored
View file

@ -1,3 +0,0 @@
[navigate-to-javascript-url-006.sub.html]
[A cross-origin subframe navigating to a javascript: URL should use the CSP policy associated to its document for pre-navigation check and execute the JavaScript code modified by its default policy.]
expected: FAIL

6
tests/wpt/meta/trusted-types/navigate-to-javascript-url-csp-headers.html.ini vendored
View file

@ -1,11 +1,5 @@
[navigate-to-javascript-url-csp-headers.html]
expected: TIMEOUT
[One enforce require-trusted-types-for 'script' directive: navigation is blocked, violation is reported.]
expected: FAIL
[One report-only require-trusted-types-for 'script' directive: navigation continues, violation is reported.]
expected: FAIL
[Multiple enforce require-trusted-types-for directives: one violation reported for each require-trusted-types-for 'script', invalid sink groups ignored.]
expected: FAIL

6
tests/wpt/meta/trusted-types/trusted-types-navigation.html.ini vendored
View file

@ -164,14 +164,8 @@
[Navigate a window via anchor with javascript:-urls in enforcing mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls w/ default policy in enforcing mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls in report-only mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls w/ default policy in report-only mode.]
expected: FAIL
[Navigate a frame via anchor with javascript:-urls in enforcing mode.]
expected: FAIL