servo/components/net/fetch
Tim van der Lippe baa18e18af
Support CSP report-only header (#36623)
This turned out to be a full rabbit hole. The new header
is parsed in the new `parse_csp_list_from_metadata` which
sets `disposition` to `report.

I was testing this with
`script-src-report-only-policy-works-with-external-hash-policy.html`
which was blocking the script incorrectly. Turns out that there
were multiple bugs in the CSP library, as well as a missing
check in `fetch` to report violations.

Additionally, in several locations we were manually reporting csp
violations, instead of the new `global.report_csp_violations`. As
a result of that, they would double report, since the report-only
header would be appended as a policy and now would report twice.

Now, all callsides use `global.report_csp_violations`. As a nice
side-effect, I added the code to set source file information,
since that was already present for the `eval` check, but nowhere
else.

Part of #36437

Requires servo/rust-content-security-policy#5

---------

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
Signed-off-by: Tim van der Lippe <TimvdLippe@users.noreply.github.com>
2025-04-25 19:59:44 +00:00
..
cors_cache.rs Update rustfmt to the 2024 style edition (#35764) 2025-03-03 11:26:53 +00:00
fetch_params.rs add minimal implementation of FetchParams (#34833) 2025-01-12 14:37:25 +00:00
headers.rs Implement fetch metadata headers (#33830) 2024-10-16 04:15:56 +00:00
methods.rs Support CSP report-only header (#36623) 2025-04-25 19:59:44 +00:00