[Gecko Bug 1935434] Implement forgiving parsing for trusted-types CSP directive. #51691
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wpt-pr-bot
approved these changes
Mar 28, 2025
moz-wptsync-bot
force-pushed
the
gecko/1935434
branch
from
4e0d4eb to
72897d8
Compare
Currently, we just discard the whole directive if an invalid token is found. With this patch, we instead ignore such a token. Also improves tests in should-trusted-type-policy-creation-be-blocked-by-csp-002.html so that we really check that the original trusted-types directive is preserved after serialization. See w3c/webappsec-csp#363 (comment) Differential Revision: https://phabricator.services.mozilla.com/D243358 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1935434 gecko-commit: f27925f3d6f792efb037cdb55bb98b972c11c1c6 gecko-reviewers: smaug
moz-wptsync-bot
force-pushed
the
gecko/1935434
branch
from
72897d8 to
16202f3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, we just discard the whole directive if an invalid token is
found. With this patch, we instead ignore such a token. Also improves
tests in should-trusted-type-policy-creation-be-blocked-by-csp-002.html
so that we really check that the original trusted-types directive is
preserved after serialization.
See w3c/webappsec-csp#363 (comment)
Differential Revision: https://phabricator.services.mozilla.com/D243358
bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1935434
gecko-commit: 3a01a7335e0b5b05b49cbda19324a9b8a06ab315
gecko-reviewers: smaug