Add support for Upgrade request to a potentially trustworthy URL.#34986
Add support for Upgrade request to a potentially trustworthy URL.#34986jdm merged 2 commits intoservo:mainfrom
Conversation
|
Hi @jdm , Please take a look. |
804fa3d to
a4a7efd
Compare
simonwuelker
left a comment
There was a problem hiding this comment.
Nice, just one more question and a couple of nits.
You will likely also need to update the test expectations, as new tests will probably pass as a result of this PR.
|
🔨 Triggering try run (#12802527980) for Linux WPT |
|
Test results for linux-wpt-layout-2020 from try job (#12802527980): Flaky unexpected result (19)
Stable unexpected results that are known to be intermittent (14)
Stable unexpected results (24)
|
|
|
|
The tests are failing because we're missing an implementation of https://w3c.github.io/webappsec-upgrade-insecure-requests/#should-upgrade-for-client that is called in step 3 of https://w3c.github.io/webappsec-upgrade-insecure-requests/#upgrade-request , so we're upgrading requests that should not be upgraded. |
|
I've started sketching some code to support 1) reading the CSP policy to enforce upgrading requests, 2) inheriting the policy value into nested documents/browsing contexts, 3) storing the computed policy value in the request object. I'll see if I can get it finished tonight and put up a pull request. |
|
Done: shubhamg13#1 |
|
If we rebase on top of the latest changes on main (including #34952) then we'll be able to see just the tests that now pass. |
|
🔨 Triggering try run (#12832486991) for Linux WPT |
|
Huh, where did my commit from the other PR go? Did it get lost in the rebase? |
|
Test results for linux-wpt-layout-2020 from try job (#12832486991): Flaky unexpected result (24)
Stable unexpected results that are known to be intermittent (16)
Stable unexpected results (24)
|
|
🔨 Triggering try run (#12839868453) for Linux WPT |
|
Test results for linux-wpt-layout-2020 from try job (#12839868453): Flaky unexpected result (26)
Stable unexpected results that are known to be intermittent (19)
Stable unexpected results (22)
|
|
|
|
@shubhamg13 Can you update the expected test results now that there are passing tests? |
f77018b to
8709051
Compare
I just updated the tests, sorry for delay I was away for some other work. |
|
@simonwuelker Would you like to review the second commit here, since I wrote it? |
components/net/fetch/methods.rs
Outdated
| let content_type = request.headers.typed_get::<ContentType>(); | ||
| if content_type.is_some_and(|ct| { | ||
| let mime: Mime = ct.clone().into(); | ||
| mime.type_() == mime::APPLICATION && mime.subtype() == mime::WWW_FORM_URLENCODED | ||
| }) { | ||
| return None; | ||
| } |
There was a problem hiding this comment.
Did you get any clarification from WebAppsWG regarding the definition of a form submission request?
I also suggest wrapping these lines into a utility function, since these checks are heuristic-based and there might be a possibility we need to change them later.
There was a problem hiding this comment.
I got a response like it "when they wrote it, there wasn't much spec-level plumbing for same and it should be easy to do so". And later @jdm suggested that this topic need investigation in future.
Added a utility function,PTAL.
d7a4d30 to
f66ec4a
Compare
Head branch was pushed to by a user without write access
xiaochengh
left a comment
There was a problem hiding this comment.
Looks good in general, with some minor comments.
Signed-off-by: Shubham Gupta <[email protected]>
…workers. Signed-off-by: Josh Matthews <[email protected]>
Add support for Upgrade request to a potentially trustworthy URL.
./mach build -ddoes not report any errors./mach test-tidydoes not report any errors