Attachment #395976 for bug #210256

View Details Raw Unified Return to Bug 210256

| Differences between



2020-04-09  Keith Miller  <keith_miller@apple.com>

        Remove legacy X-WebKit-CSP header support
        https://bugs.webkit.org/show_bug.cgi?id=210256
        <rdar://problem/60634363>

        Reviewed by NOBODY (OOPS!).

        Supporting this header is causes compatibly issues for some sites
        and they appear to be misconfigured. Additionally, no other
        browser has supported these headers in many years. This patch
        removes all support for the legacy X-WebKit-CSP header.

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv):
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList):
        * page/csp/ContentSecurityPolicyResponseHeaders.cpp:
        (WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):
        * page/csp/ContentSecurityPolicyResponseHeaders.h:
        * platform/network/HTTPHeaderNames.in:
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::isSafeCrossOriginResponseHeader):

2020-04-07  Simon Fraser  <simon.fraser@apple.com>

        Use RectEdges<> in some scrolling tree code



            contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::Enforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
        break;

    case HTTPHeaderName::XWebKitCSP:
        if (isInDocumentHead)
            contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::PrefixedEnforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
        break;

    default:
        break;
    }



ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList(ContentSecurityPolicy& policy, ContentSecurityPolicyHeaderType type)
    : m_policy(policy)
    , m_headerType(type)
    , m_reportOnly(type == ContentSecurityPolicyHeaderType::Report)
{
    m_reportOnly = (type == ContentSecurityPolicyHeaderType::Report || type == ContentSecurityPolicyHeaderType::PrefixedReport);
}

std::unique_ptr<ContentSecurityPolicyDirectiveList> ContentSecurityPolicyDirectiveList::create(ContentSecurityPolicy& policy, const String& header, ContentSecurityPolicyHeaderType type, ContentSecurityPolicy::PolicyFrom from)



    if (!policyValue.isEmpty())
        m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::Report });

    policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSP);
    if (!policyValue.isEmpty())
        m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedEnforce });

    policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSPReportOnly);
    if (!policyValue.isEmpty())
        m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedReport });

    m_httpStatusCode = response.httpStatusCode();
}




enum class ContentSecurityPolicyHeaderType {
    Report,
    Enforce,
    PrefixedReport,
    PrefixedEnforce,
};

class ContentSecurityPolicyResponseHeaders {



X-DNS-Prefetch-Control
X-Frame-Options
X-SourceMap
X-WebKit-CSP
X-WebKit-CSP-Report-Only
X-XSS-Protection
X-Temp-Tablet




        || name == HTTPHeaderName::XContentTypeOptions
        || name == HTTPHeaderName::XDNSPrefetchControl
        || name == HTTPHeaderName::XFrameOptions
        || name == HTTPHeaderName::XWebKitCSP
        || name == HTTPHeaderName::XWebKitCSPReportOnly
        || name == HTTPHeaderName::XXSSProtection;
}




2020-04-09  Keith Miller  <keith_miller@apple.com>

        Remove legacy X-WebKit-CSP header support
        https://bugs.webkit.org/show_bug.cgi?id=210256

        Reviewed by NOBODY (OOPS!).

        Fix tests so they ensure we don't respect legacy CSP headers anymore.

        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt:
        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:

2020-04-07  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Change ATK mapping of the ARIA alert and alertdialog roles

Lines 1-7 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt -4 / +7 lines
1	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl because it does not appear in the form-action directive of the Content Security Policy.	1	This page was requested with the HTTP method POST.
2		2
3	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.	3	Parameters:
		4
		5	fieldname = fieldvalue
4		6
5	============== Back Forward List ==============	7	============== Back Forward List ==============
6	curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html nav target	8	http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html nav target
		9	curr-> http://127.0.0.1:8000/navigation/resources/form-target.pl nav target
7	===============================================	10	===============================================

Lines 25-30 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html -1 / +5 lines
25	<input type='submit' id='submit' value='submit'>	25	<input type='submit' id='submit' value='submit'>
26	</form>	26	</form>
27		27
28	<p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>	28	<p>
		29	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
		30
		31	Update: Since we no longer support X-WebKit-CSP all the form should be submitted.
		32	</p>
29	</body>	33	</body>
30	</html>	34	</html>

Lines 1-7 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt -4 / +6 lines
1	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue because it does not appear in the form-action directive of the Content Security Policy.	1	This page was requested with the HTTP method GET.
2		2
3	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.	3	Parameters:
		4
		5	fieldname = fieldvalue
4		6
5	============== Back Forward List ==============	7	============== Back Forward List ==============
6	curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html nav target	8	curr-> http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue nav target
7	===============================================	9	===============================================

Lines 23-28 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html -1 / +5 lines
23	<input type='submit' id='submit' value='submit'>	23	<input type='submit' id='submit' value='submit'>
24	</form>	24	</form>
25		25
26	<p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>	26	<p>
		27	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
		28
		29	Update: Since we no longer support X-WebKit-CSP the form should be submitted.
		30	</p>
27	</body>	31	</body>
28	</html>	32	</html>

Lines 1-6 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt -2 / +2 lines
1	CONSOLE MESSAGE: Refused to load javascript:alert("FAIL!") because it does not appear in the form-action directive of the Content Security Policy.	1	ALERT: RAN CODE CORRECTLY!
2		2
3	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.	3	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert. Update: Since we no longer support X-WebKit-CSP the form should be submitted.
4		4
5	============== Back Forward List ==============	5	============== Back Forward List ==============
6	curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html nav target	6	curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html nav target

Lines 20-30 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html -2 / +6 lines
20	</script>	20	</script>
21	</head>	21	</head>
22	<body>	22	<body>
23	<form action='javascript:alert("FAIL!")' id='theform' method='post'>	23	<form action='javascript:alert("RAN CODE CORRECTLY!")' id='theform' method='post'>
24	<input type='text' name='fieldname' value='fieldvalue'>	24	<input type='text' name='fieldname' value='fieldvalue'>
25	<input type='submit' id='submit' value='submit'>	25	<input type='submit' id='submit' value='submit'>
26	</form>	26	</form>
27		27
28	<p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.</p>	28	<p>
		29	Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.
		30
		31	Update: Since we no longer support X-WebKit-CSP the form should be submitted.
		32	</p>
29	</body>	33	</body>
30	</html>	34	</html>



This page was requested with the HTTP method GET.

Parameters:


============== Back Forward List ==============
curr->  http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html  **nav target**
===============================================

Lines 25-30 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html -1 / +5 lines
25	<input type='submit' id='submit' value='submit'>	25	<input type='submit' id='submit' value='submit'>
26	</form>	26	</form>
27		27
28	<p>Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>	28	<p>
		29	Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
		30
		31	Update: Since we no longer support X-WebKit-CSP the form should be submitted.
		32	</p>
29	</body>	33	</body>
30	</html>	34	</html>

Lines 1-6 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt -3 / +1 lines
1	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.	1	Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
2	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
3	Only the first two of these scripts should execute even though there are parse errors in the policy.
4		2
5		3
6		4

Lines 7-18 var tests = [ a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html -2 / +4 lines
7	['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],	7	['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],
8	['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],	8	['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
9	['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],	9	['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
10	['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],	10	['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
11	['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],	11	['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
12	];	12	];
13	</script>	13	</script>
14	</head>	14	</head>
15	<body onload="testExperimentalPolicy()">	15	<body onload="testExperimentalPolicy()">
16	<p>	16	<p>
17	Only the first two of these scripts should execute even though there are parse errors in the policy.	17	Only the first two of these scripts should execute even though there are parse errors in the policy.
		18
		19	Update: Since we no longer support X-WebKit-CSP all the scripts should run.
18	</p>	20	</p>



None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
None of these scripts should execute, as all the nonces are invalid.






<script src='../resources/multiple-iframe-module-test.js'></script>
<script>
var tests = [
    ['yes', 'script-src \'n', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
    ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-     \'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
    ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
];
</script>
</head>
<body onload="testExperimentalPolicy()">
    <p>
        None of these scripts should execute, as all the nonces are invalid.

        Update: Since we no longer support X-WebKit-CSP all the scripts should run.
    </p>



CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
FAIL did not execute script.






</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script>
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php"></iframe>
</body>



CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
CONSOLE MESSAGE: line 11: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
PASS did execute script.
PASS did not execute script.



--------
Frame: '<!--frame1-->'
--------
CSP report received:
CONTENT_TYPE: application/csp-report
HTTP_HOST: 127.0.0.1:8000
HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
REQUEST_METHOD: POST
REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
=== POST DATA ===
{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}



<html>
<head>
<script nonce="dump-as-text">
if (window.testRunner)
    testRunner.dumpAsText();
    testRunner.dumpChildFramesAsText();
}
</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script>
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>
once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>

Lines 1-3 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt -2 / +2 lines
1	CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.	1	CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
2	CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	2	CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
3	PASS did not execute script.	3	PASS did execute script.



</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script>
document.getElementById("result").textContent = "PASS did execute script.";
</script>
</body>
</html>

Lines 1-6 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt -2 / +1 lines
1	CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	1	CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
2	CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	2	PASS did execute script.
3	PASS did not execute script.
4		3
5		4
6		5



</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script>
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>
</body>

Lines 1-6 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt -2 / +1 lines
1	CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	1	CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
2	CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	2	PASS did execute script.
3	PASS did not execute script.
4		3
5		4
6		5



</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script>
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php"></iframe>
</body>



CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
PASS did execute script.
CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
PASS did not execute script.



--------
Frame: '<!--frame1-->'
--------
CSP report received:
CONTENT_TYPE: application/csp-report
HTTP_HOST: 127.0.0.1:8000
HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
REQUEST_METHOD: POST
REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
=== POST DATA ===
{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}



<html>
<head>
<script nonce="dump-as-text">
if (window.testRunner)
    testRunner.dumpAsText();
    testRunner.dumpChildFramesAsText();
}
</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>
once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>

Lines 1-4 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt -3 / +1 lines
1	CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.	1	CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
2	CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.	2	PASS did execute script.
3	CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
4	PASS did not execute script.



</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
document.getElementById("result").textContent = "PASS did execute script.";
</script>
</body>
</html>



PASS did execute script.
CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
PASS did not execute script.



--------
Frame: '<!--frame1-->'
--------
CSP report received:
CONTENT_TYPE: application/csp-report
HTTP_HOST: 127.0.0.1:8000
HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
REQUEST_METHOD: POST
REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
=== POST DATA ===
{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}



<html>
<head>
<script nonce="dump-as-text">
if (window.testRunner)
    testRunner.dumpAsText();
    testRunner.dumpChildFramesAsText();
}
</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>
once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>



PASS did execute script.
CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
PASS did not execute script.



--------
Frame: '<!--frame1-->'
--------
CSP report received:
CONTENT_TYPE: application/csp-report
HTTP_HOST: 127.0.0.1:8000
HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php
REQUEST_METHOD: POST
REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
=== POST DATA ===
{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}



<head>
<meta http-equiv="X-WebKit-CSP" content="script-src 'nonce-dump-as-text'">
<script nonce="dump-as-text">
if (window.testRunner)
    testRunner.dumpAsText();
    testRunner.dumpChildFramesAsText();
}
</script>
</head>
<body>
<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
document.getElementById("result").textContent = "PASS did execute script.";
</script>
<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>
once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>

Lines 1-6 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt -3 / +1 lines
1	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.	1	Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
2	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
3	Only the first two of these scripts should execute even though there are parse errors in the policy.
4		2
5		3
6		4

Lines 7-18 var tests = [ a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html -2 / +4 lines
7	['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],	7	['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],
8	['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],	8	['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
9	['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],	9	['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
10	['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],	10	['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
11	['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],	11	['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
12	];	12	];
13	</script>	13	</script>
14	</head>	14	</head>
15	<body onload="testExperimentalPolicy()">	15	<body onload="testExperimentalPolicy()">
16	<p>	16	<p>
17	Only the first two of these scripts should execute even though there are parse errors in the policy.	17	Only the first two of these scripts should execute even though there are parse errors in the policy.
		18
		19	Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
18	</p>	20	</p>



None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
None of these scripts should execute, as all the nonces are invalid.






<script src='../resources/multiple-iframe-test.js'></script>
<script>
var tests = [
    ['yes', 'script-src \'n', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
    ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-     \'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
    ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
    ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
];
</script>
</head>
<body onload="testExperimentalPolicy()">
  <p>
      None of these scripts should execute, as all the nonces are invalid.

      Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
  </p>

Return to Bug 210256

Lines 3645-3655 void Document::processHttpEquiv(const String& equiv, const String& content, bool a/Source/WebCore/dom/Document.cpp_sec1
- a/Source/WebCore/dom/Document.cpp -5 lines
3645	contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::Enforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);	3645	contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::Enforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
3646	break;	3646	break;
3647		3647
3648	case HTTPHeaderName::XWebKitCSP:
3649	if (isInDocumentHead)
3650	contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::PrefixedEnforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
3651	break;
3652
3653	default:	3648	default:
3654	break;	3649	break;
3655	}	3650	}

Lines 117-124 static inline bool checkMediaType(ContentSecurityPolicyMediaListDirective* direc a/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp_sec1
- a/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp -1 / +1 lines
117	ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList(ContentSecurityPolicy& policy, ContentSecurityPolicyHeaderType type)	117	ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList(ContentSecurityPolicy& policy, ContentSecurityPolicyHeaderType type)
118	: m_policy(policy)	118	: m_policy(policy)
119	, m_headerType(type)	119	, m_headerType(type)
		120	, m_reportOnly(type == ContentSecurityPolicyHeaderType::Report)
120	{	121	{
121	m_reportOnly = (type == ContentSecurityPolicyHeaderType::Report \|\| type == ContentSecurityPolicyHeaderType::PrefixedReport);
122	}	122	}
123		123
124	std::unique_ptr<ContentSecurityPolicyDirectiveList> ContentSecurityPolicyDirectiveList::create(ContentSecurityPolicy& policy, const String& header, ContentSecurityPolicyHeaderType type, ContentSecurityPolicy::PolicyFrom from)	124	std::unique_ptr<ContentSecurityPolicyDirectiveList> ContentSecurityPolicyDirectiveList::create(ContentSecurityPolicy& policy, const String& header, ContentSecurityPolicyHeaderType type, ContentSecurityPolicy::PolicyFrom from)

Lines 41-54 ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders(const a/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp_sec1
- a/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp -8 lines
41	if (!policyValue.isEmpty())	41	if (!policyValue.isEmpty())
42	m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::Report });	42	m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::Report });
43		43
44	policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSP);
45	if (!policyValue.isEmpty())
46	m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedEnforce });
47
48	policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSPReportOnly);
49	if (!policyValue.isEmpty())
50	m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedReport });
51
52	m_httpStatusCode = response.httpStatusCode();	44	m_httpStatusCode = response.httpStatusCode();
53	}	45	}
54		46

Lines 435-442 static bool isSafeCrossOriginResponseHeader(HTTPHeaderName name) a/Source/WebCore/platform/network/ResourceResponseBase.cpp_sec1
- a/Source/WebCore/platform/network/ResourceResponseBase.cpp -2 lines
435	\|\| name == HTTPHeaderName::XContentTypeOptions	435	\|\| name == HTTPHeaderName::XContentTypeOptions
436	\|\| name == HTTPHeaderName::XDNSPrefetchControl	436	\|\| name == HTTPHeaderName::XDNSPrefetchControl
437	\|\| name == HTTPHeaderName::XFrameOptions	437	\|\| name == HTTPHeaderName::XFrameOptions
438	\|\| name == HTTPHeaderName::XWebKitCSP
439	\|\| name == HTTPHeaderName::XWebKitCSPReportOnly
440	\|\| name == HTTPHeaderName::XXSSProtection;	438	\|\| name == HTTPHeaderName::XXSSProtection;
441	}	439	}
442		440

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +24 lines
		1	2020-04-09 Keith Miller <keith_miller@apple.com>
		2
		3	Remove legacy X-WebKit-CSP header support
		4	https://bugs.webkit.org/show_bug.cgi?id=210256
		5	<rdar://problem/60634363>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	Supporting this header is causes compatibly issues for some sites
		10	and they appear to be misconfigured. Additionally, no other
		11	browser has supported these headers in many years. This patch
		12	removes all support for the legacy X-WebKit-CSP header.
		13
		14	* dom/Document.cpp:
		15	(WebCore::Document::processHttpEquiv):
		16	* page/csp/ContentSecurityPolicyDirectiveList.cpp:
		17	(WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList):
		18	* page/csp/ContentSecurityPolicyResponseHeaders.cpp:
		19	(WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):
		20	* page/csp/ContentSecurityPolicyResponseHeaders.h:
		21	* platform/network/HTTPHeaderNames.in:
		22	* platform/network/ResourceResponseBase.cpp:
		23	(WebCore::isSafeCrossOriginResponseHeader):
		24
1	2020-04-07 Simon Fraser <simon.fraser@apple.com>	25	2020-04-07 Simon Fraser <simon.fraser@apple.com>
2		26
3	Use RectEdges<> in some scrolling tree code	27	Use RectEdges<> in some scrolling tree code

Lines 36-43 class ResourceResponse; a/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h_sec1
- a/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h -2 lines
36	enum class ContentSecurityPolicyHeaderType {	36	enum class ContentSecurityPolicyHeaderType {
37	Report,	37	Report,
38	Enforce,	38	Enforce,
39	PrefixedReport,
40	PrefixedEnforce,
41	};	39	};
42		40
43	class ContentSecurityPolicyResponseHeaders {	41	class ContentSecurityPolicyResponseHeaders {

Lines 102-109 X-Content-Type-Options a/Source/WebCore/platform/network/HTTPHeaderNames.in_sec1
- a/Source/WebCore/platform/network/HTTPHeaderNames.in -2 lines
102	X-DNS-Prefetch-Control	102	X-DNS-Prefetch-Control
103	X-Frame-Options	103	X-Frame-Options
104	X-SourceMap	104	X-SourceMap
105	X-WebKit-CSP
106	X-WebKit-CSP-Report-Only
107	X-XSS-Protection	105	X-XSS-Protection
108	X-Temp-Tablet	106	X-Temp-Tablet
109		107

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +44 lines
		1	2020-04-09 Keith Miller <keith_miller@apple.com>
		2
		3	Remove legacy X-WebKit-CSP header support
		4	https://bugs.webkit.org/show_bug.cgi?id=210256
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Fix tests so they ensure we don't respect legacy CSP headers anymore.
		9
		10	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt:
		11	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html:
		12	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt:
		13	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html:
		14	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt:
		15	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html:
		16	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt:
		17	* http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html:
		18	* http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt:
		19	* http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html:
		20	* http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt:
		21	* http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html:
		22	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
		23	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php:
		24	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
		25	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
		26	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
		27	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
		28	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
		29	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
		30	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
		31	* http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
		32	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
		33	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
		34	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
		35	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
		36	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
		37	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
		38	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
		39	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
		40	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt:
		41	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html:
		42	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt:
		43	* http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
		44
1	2020-04-07 Joanmarie Diggs <jdiggs@igalia.com>	45	2020-04-07 Joanmarie Diggs <jdiggs@igalia.com>
2		46
3	AX: Change ATK mapping of the ARIA alert and alertdialog roles	47	AX: Change ATK mapping of the ARIA alert and alertdialog roles

Lines 1-26 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt -23 / +1 lines
1	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''n'. It will be ignored.	1	None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
2	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
3	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
4	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
5	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
6	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
7	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
8	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
9	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
10	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
11	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
12	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
13	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
14	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
15	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
16	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
17	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
18	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
19	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
20	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
21	CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
22	CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
23	None of these scripts should execute, as all the nonces are invalid.
24		2
25		3
26		4

Lines 4-23 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html -10 / +12 lines
4	<script src='../resources/multiple-iframe-module-test.js'></script>	4	<script src='../resources/multiple-iframe-module-test.js'></script>
5	<script>	5	<script>
6	var tests = [	6	var tests = [
7	['no', 'script-src \'n', 'resources/script.js', ''],	7	['yes', 'script-src \'n', 'resources/script.js', ''],
8	['no', 'script-src \'nonce', 'resources/script.js', ''],	8	['yes', 'script-src \'nonce', 'resources/script.js', ''],
9	['no', 'script-src \'nonce-\'', 'resources/script.js', ''],	9	['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
10	['no', 'script-src \'nonce-', 'resources/script.js', ''],	10	['yes', 'script-src \'nonce-', 'resources/script.js', ''],
11	['no', 'script-src nonce-abcd', 'resources/script.js', ''],	11	['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
12	['no', 'script-src \'nonce- \'', 'resources/script.js', ''],	12	['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
13	['no', 'script-src \'nonce- \'', 'resources/script.js', ''],	13	['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
14	['no', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],	14	['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
15	['no', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],	15	['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
16	['no', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],	16	['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
17	];	17	];
18	</script>	18	</script>
19	</head>	19	</head>
20	<body onload="testExperimentalPolicy()">	20	<body onload="testExperimentalPolicy()">
21	<p>	21	<p>
22	None of these scripts should execute, as all the nonces are invalid.	22	None of these scripts should execute, as all the nonces are invalid.
		23
		24	Update: Since we no longer support X-WebKit-CSP all the scripts should run.
23	</p>	25	</p>

Lines 6-22 a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php_sec1
- a/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php -5 / +5 lines
6	<html>	6	<html>
7	<head>	7	<head>
8	<script nonce="dump-as-text">	8	<script nonce="dump-as-text">
9	if (window.testRunner) {	9	if (window.testRunner)
10	testRunner.dumpAsText();	10	testRunner.dumpAsText();
11	testRunner.dumpChildFramesAsText();
12	}
13	</script>	11	</script>
14	</head>	12	</head>
15	<body>	13	<body>
16	<p id="result">PASS did not execute script.</p>	14	<p id="result">FAIL did not execute script.</p>
17	<script>	15	<script>
18	document.getElementById("result").textContent = "FAIL did execute script.";	16	document.getElementById("result").textContent = "PASS did execute script.";
19	</script>	17	</script>
		18	<!-- Call testRunner.dumpChildFramesAsText() and load
20	<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>	19	<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>
		20	once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
21	</body>	21	</body>
22	</html>	22	</html>