To be able to abort the update, extract the functionality into a
separate method. Otherwise, we don't run the `node.rev_version`
at the end, which according to the comment is probably important.

Not all `style-src` tests pass and I don't fully understand why yet,
but I presume it has to do with some special quirks of stylesheets
that other CSP checks don't have. All `style-src-attr-elem` tests
pass though.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

To be able to abort the update, extract the functionality into a
separate method. Otherwise, we don't run the `node.rev_version`
at the end, which according to the comment is probably important.

Not all `style-src` tests pass and I don't fully understand why yet,
but I presume it has to do with some special quirks of stylesheets
that other CSP checks don't have. All `style-src-attr-elem` tests
pass though.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

To be able to abort the update, extract the functionality into a
separate method. Otherwise, we don't run the `node.rev_version`
at the end, which according to the comment is probably important.

Not all `style-src` tests pass and I don't fully understand why yet,
but I presume it has to do with some special quirks of stylesheets
that other CSP checks don't have. All `style-src-attr-elem` tests
pass though.

Part of #4577

Signed-off-by: Tim van der Lippe <[email protected]>

Also update the `html/dom/reflection-metadata.html` test
to handle the case where `nonce` does not reflect back
to the attribute after an IDL change.

Part of web-platform-tests#4577
Fixes web-platform-tests#43286

Signed-off-by: Tim van der Lippe <[email protected]>

Also update the `html/dom/reflection-metadata.html` test
to handle the case where `nonce` does not reflect back
to the attribute after an IDL change.

Part of web-platform-tests#4577
Fixes web-platform-tests#43286

Signed-off-by: Tim van der Lippe <[email protected]>

Also update the `html/dom/reflection-metadata.html` test
to handle the case where `nonce` does not reflect back
to the attribute after an IDL change.

Part of web-platform-tests#4577
Fixes web-platform-tests#43286

Signed-off-by: Tim van der Lippe <[email protected]>

Also update the `html/dom/reflection-metadata.html` test
to handle the case where `nonce` does not reflect back
to the attribute after an IDL change.

Part of web-platform-tests#4577
Fixes web-platform-tests#43286

Signed-off-by: Tim van der Lippe <[email protected]>

Also update the `html/dom/reflection-metadata.html` test
to handle the case where `nonce` does not reflect back
to the attribute after an IDL change.

Part of #4577
Fixes #43286

Signed-off-by: Tim van der Lippe <[email protected]>

This way, we don't always set the destination to Document
(which is as the spec is written today). Instead, we set
it it in the load_data, depending on which context we
load it from.

Doing so allows us to set the `Destination::IFrame` for
navigations in iframes, enabling all frame-related CSP
checks.

While we currently block iframes when `frame-src` or
`child-src` is set, their respective tests don't pass
yet. That's because we don't yet handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than
erroring. That's because it was using the wrong JS
test variable.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

This way, we don't always set the destination to Document
(which is as the spec is written today). Instead, we set
it it in the load_data, depending on which context we
load it from.

Doing so allows us to set the `Destination::IFrame` for
navigations in iframes, enabling all frame-related CSP
checks.

While we currently block iframes when `frame-src` or
`child-src` is set, their respective tests don't pass
yet. That's because we don't yet handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than
erroring. That's because it was using the wrong JS
test variable.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

This way, we don't always set the destination to Document
(which is as the spec is written today). Instead, we set
it it in the load_data, depending on which context we
load it from.

Doing so allows us to set the `Destination::IFrame` for
navigations in iframes, enabling all frame-related CSP
checks.

While we currently block iframes when `frame-src` or
`child-src` is set, their respective tests don't pass
yet. That's because we don't yet handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than
erroring. That's because it was using the wrong JS
test variable.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

This way, we don't always set the destination to Document
(which is as the spec is written today). Instead, we set
it it in the load_data, depending on which context we
load it from.

Doing so allows us to set the `Destination::IFrame` for
navigations in iframes, enabling all frame-related CSP
checks.

While we currently block iframes when `frame-src` or
`child-src` is set, their respective tests don't pass
yet. That's because we don't yet handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than
erroring. That's because it was using the wrong JS
test variable.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

This way, we don't always set the destination to Document
(which is as the spec is written today). Instead, we set
it it in the load_data, depending on which context we
load it from.

Doing so allows us to set the `Destination::IFrame` for
navigations in iframes, enabling all frame-related CSP
checks.

While we currently block iframes when `frame-src` or
`child-src` is set, their respective tests don't pass
yet. That's because we don't yet handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than
erroring. That's because it was using the wrong JS
test variable.

Part of #4577

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of web-platform-tests#4577
Part of web-platform-tests#35035

Signed-off-by: Tim van der Lippe <[email protected]>

These changes allow a minimal set of checks for font-src
CSP checks to pass.

Part of #4577
Part of #35035

Signed-off-by: Tim van der Lippe <[email protected]>

Cloned nodes were re-parsing already-parsed style
attributes. As such, they were also checking CSP, which
shouldn't happen as the original node already was checked
for it.

The existing WPT test now mostly passes. It had two cases
which were passing in no browsers. Therefore, update it
to reflect browser behavior (which Servo also now does).

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

Cloned nodes were re-parsing already-parsed style
attributes. As such, they were also checking CSP, which
shouldn't happen as the original node already was checked
for it.

The existing WPT test now mostly passes. It had two cases
which were passing in no browsers. Therefore, update it
to reflect browser behavior (which Servo also now does).

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

Cloned nodes were re-parsing already-parsed style
attributes. As such, they were also checking CSP, which
shouldn't happen as the original node already was checked
for it.

The existing WPT test now mostly passes. It had two cases
which were passing in no browsers.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

Cloned nodes were re-parsing already-parsed style
attributes. As such, they were also checking CSP, which
shouldn't happen as the original node already was checked
for it.

The existing WPT test now mostly passes. It had two cases
which were passing in no browsers.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

Cloned nodes were re-parsing already-parsed style
attributes. As such, they were also checking CSP, which
shouldn't happen as the original node already was checked
for it.

The existing WPT test now mostly passes. It had two cases
which were passing in no browsers.

Part of #4577

Signed-off-by: Tim van der Lippe <[email protected]>

This was a bit confusing at first, but the report-only only
had an effect if it was used in conjunction with the regular
CSP header. This is incorrect, as the report-only header
can be present on its own.

Additionally, there was double-logic for parsing the CSP list
values, since we can only concatenate CSP lists if we have
an initial value, which requires a concrete policy value.

Therefore, abstract that way by looping over both headers and
handling the case where initially it is `None` and, if the
CSP header is not present, still `None` when we parse
the `report-only` header.

Additionally, update two WPT tests. One was expecting the image
to load, yet was showing the fail image. The other one is
currently still failing for Servo, but crashes the test runner.
Now it no longer times out, but has the wrong value for
number of reports.

Part of web-platform-tests#4577

Signed-off-by: Tim van der Lippe <[email protected]>

This was a bit confusing at first, but the report-only only
had an effect if it was used in conjunction with the regular
CSP header. This is incorrect, as the report-only header
can be present on its own.

Additionally, there was double-logic for parsing the CSP list
values, since we can only concatenate CSP lists if we have
an initial value, which requires a concrete policy value.

Therefore, abstract that way by looping over both headers and
handling the case where initially it is `None` and, if the
CSP header is not present, still `None` when we parse
the `report-only` header.

Additionally, update two WPT tests. One was expecting the image
to load, yet was showing the fail image. The other one is
currently still failing for Servo, but crashes the test runner.
Now it no longer times out, but has the wrong value for
number of reports.

Part of #4577

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of web-platform-tests#4577
Fixes web-platform-tests#37027

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of web-platform-tests#4577
Fixes web-platform-tests#37027

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of web-platform-tests#4577
Fixes web-platform-tests#37027

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of web-platform-tests#4577
Fixes web-platform-tests#37027

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of #4577
Fixes #37027

Signed-off-by: Tim van der Lippe <[email protected]>

Any CSP violations happening when loading a worker should be reported
on the global of the document that creates the worker. Since workers
run in different threads, we can't pass in this parent global into
the worker global scope. Instead, we need to send a message to the
parent event loop to report it on the correct global.

Part of #4577
Fixes #37027

Signed-off-by: Tim van der Lippe <[email protected]>