Page MenuHomePhabricator

Bug 1940382 - Part 4: Remove connect-src:'none' restriction from the preload-csp.sub.html.
ClosedPublic

Authored by allstarschh on Jan 23 2025, 2:31 PM.
Referenced Files
Unknown Object (File)
Tue, Apr 14, 1:06 PM
Unknown Object (File)
Sun, Apr 12, 10:14 PM
Unknown Object (File)
Fri, Apr 10, 12:05 PM
Unknown Object (File)
Fri, Apr 10, 12:41 AM
Unknown Object (File)
Thu, Apr 9, 9:11 PM
Unknown Object (File)
Mon, Apr 6, 3:03 PM
Unknown Object (File)
Mon, Apr 6, 11:00 AM
Unknown Object (File)
Apr 6 2026, 2:15 AM
Subscribers
None

Details

Summary

In the WPT PR 41665 [1],
preload-csp.sub.html was added connect-src:'none' in the CSP [2],
the reason is that the json modules will use 'connect-src' as the CSP
directive, see the destination "json" in [3].

However, this test calls "hasArrivedAtServer" to verify the result [4],
which uses 'fetch()' API. [5]

And according the CSP spec, the directive for fetch() is "connect-src" (See
the empty string in [3])

Hence the change introduced in [2] causes the call to fetch() will
violate the CSP restriction, and causes the test failed on all browser
vendors. [6]

Further check the history on the wpt.fyi in [6], we can find out all
browsers started to fail since Oct.31.2023, which is also the date the
PR 41665 [1] is merged into master [7].

Now back to the test itself, since preloading json modules is not
allowed in previous patch D234849 [8] and whatwg PR 10212 [9], we can
just simply remove the connect-src: 'none' CSP directive.

[1]: https://github.com/web-platform-tests/wpt/pull/41665
[2]: https://github.com/web-platform-tests/wpt/commit/40db1c8a3564f78156416334898f2a6914dd6de9#diff-18344ffd5be3dce2faabd52b30c10d3c7beeef3a024eac638c8e0e71b07bb7c6R2
[3]: https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
[4]: https://github.com/web-platform-tests/wpt/blob/803b53367671fef86957c611a38e1d145044a97c/preload/preload-csp.sub.html#L33
[5]: https://github.com/web-platform-tests/wpt/blob/803b53367671fef86957c611a38e1d145044a97c/preload/resources/preload_helper.js#L10
[6]: https://wpt.fyi/results/preload/preload-csp.sub.html?label=experimental&label=master&aligned
[7]: https://github.com/web-platform-tests/wpt/commit/40db1c8a3564f78156416334898f2a6914dd6de9
[8]: https://phabricator.services.mozilla.com/D234849
[9]: https://github.com/whatwg/html/pull/10212

Diff Detail

Event Timeline

phab-bot changed the visibility from "Custom Policy" to "Public (No Login Required)".
phab-bot changed the edit policy from "Custom Policy" to "Restricted Project (Project)".
phab-bot removed a project: secure-revision.
farre added a project: testing-approved.

I completely agree with that explanation!

This revision is now accepted and ready to land.Feb 6 2025, 12:31 PM
allstarschh edited the summary of this revision. (Show Details)