mirror of
https://github.com/servo/servo.git
synced 2025-08-06 22:15:33 +01:00
2c116f4011
This was a bit confusing at first, but the report-only only had an effect if it was used in conjunction with the regular CSP header. This is incorrect, as the report-only header can be present on its own. Additionally, there was double-logic for parsing the CSP list values, since we can only concatenate CSP lists if we have an initial value, which requires a concrete policy value. Therefore, abstract that way by looping over both headers and handling the case where initially it is `None` and, if the CSP header is not present, still `None` when we parse the `report-only` header. Additionally, update a WPT test. It was expecting the image to load, yet was showing the fail image. Part of #4577 Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com> |
||
|---|---|---|
| .. | ||
| post-redirect-stacktrace.https.html.ini | ||
| report-clips-sample.https.html.ini | ||
| report-frame-ancestors-no-parent-cookies.sub.html.ini | ||
| report-frame-ancestors-with-x-frame-options.sub.html.ini | ||
| report-frame-ancestors.sub.html.ini | ||
| report-multiple-violations-01.html.ini | ||
| report-multiple-violations-02.html.ini | ||
| report-only-cross-origin-frame.sub.html.ini | ||
| report-original-url-on-mixed-content-frame.https.sub.html.ini | ||
| report-strips-fragment.html.ini | ||