Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-07-24 07:40:27 +01:00
Code Issues Projects Releases Packages Wiki Activity

Add simple implementation of content-security-policy on scripts / styles

Browse source 
This needs a lot more hooks before it'll actually be a good
implementation, but for a start it can help get some feedback on if this
is the right way to go about it.

Part of servo/servo#4577
This commit is contained in:
Michael Howell 2019-09-28 19:42:40 +00:00
parent 6d488f1be2
commit b8f3e8bb2e
16 changed files with 175 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

12
components/script/dom/htmlscriptelement.rs
View file

@ -27,6 +27,7 @@ use crate::dom::performanceresourcetiming::InitiatorType;
use crate::dom::virtualmethods::VirtualMethods;
use crate::fetch::create_a_potential_CORS_request;
use crate::network_listener::{self, NetworkListener, PreInvoke, ResourceTimingListener};
use content_security_policy as csp;
use dom_struct::dom_struct;
use encoding_rs::Encoding;
use html5ever::{LocalName, Prefix};
@ -428,7 +429,16 @@ impl HTMLScriptElement {
// TODO: Step 12: nomodule content attribute
// TODO(#4577): Step 13: CSP.
// Step 13.
if !element.has_attribute(&local_name!("src")) &&
doc.should_elements_inline_type_behavior_be_blocked(
&element,
csp::InlineCheckType::Script,
&text,
) == csp::CheckResult::Blocked
{
return;
}
// Step 14.
let for_attribute = element.get_attribute(&ns!(), &local_name!("for"));