-
-
Notifications
You must be signed in to change notification settings - Fork 3.6k
Implement base-uri CSP check #42261
Copy link
Copy link
Closed
Labels
A-content/scriptRelated to the script threadRelated to the script threadA-securityC-assignedThere is someone working on resolving the issueThere is someone working on resolving the issueE-less-complexStraightforward. Recommended for a new contributor.Straightforward. Recommended for a new contributor.
Description
Calling point:
| // running Is base allowed for Document? on urlRecord and document returns "Blocked", |
Our CSP trait that needs a new method to delegate:
| pub(crate) trait CspReporting { |
Relevant spec: https://www.w3.org/TR/CSP3/#directive-base-uri
Since the CSP code lives in a separate crate (https://github.com/rust-ammonia/rust-content-security-policy) which has the relevant implementation: https://github.com/rust-ammonia/rust-content-security-policy/blob/90a0221fa0b1834c7072da4f690326c420e9b397/src/lib.rs#L341 we need to delegate to it like we do with the other trait implementations
Testing: ./mach test-wpt /content-security-policy/base-uri
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
A-content/scriptRelated to the script threadRelated to the script threadA-securityC-assignedThere is someone working on resolving the issueThere is someone working on resolving the issueE-less-complexStraightforward. Recommended for a new contributor.Straightforward. Recommended for a new contributor.