153167 2016-01-15 18:08:44 -0800 CSP: 'sandbox' should be ignored in report-only mode 2016-02-15 10:54:30 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Local Build All All RESOLVED FIXED BlinkMergeCandidate, InRadar P2 Normal --- 1 dbates dbates bfulgham commit-queue mkwst webkit-bug-importer oldest_to_newest 1156062 0 dbates 2016-01-15 18:08:44 -0800 We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=165322>. CSP: 'sandbox' should be ignored in report-only mode. This is the behavior Firefox is running with[1], and has recently been explicitly clarified in the spec[2]. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=671389 [2]: https://github.com/w3c/webappsec/commit/2cc237a696e982be59886c8f2ba0ed2d84f22c81 1159619 1 webkit-bug-importer 2016-01-27 20:57:08 -0800 <rdar://problem/24383344> 1164265 2 dbates 2016-02-12 12:25:16 -0800 Disregard comment #1. We have an existing radar... 1164266 3 dbates 2016-02-12 12:25:26 -0800 <rdar://problem/22708669> 1164443 4 271250 dbates 2016-02-12 17:09:38 -0800 Created attachment 271250 Patch 1164764 5 271250 bfulgham 2016-02-15 09:48:46 -0800 Comment on attachment 271250 Patch r=me 1164779 6 271250 dbates 2016-02-15 10:54:28 -0800 Comment on attachment 271250 Patch Clearing flags on attachment: 271250 Committed r196582: <http://trac.webkit.org/changeset/196582> 1164780 7 dbates 2016-02-15 10:54:30 -0800 All reviewed patches have been landed. Closing bug. 271250 2016-02-12 17:09:38 -0800 2016-02-15 10:54:28 -0800 Patch bug-153167-20160212170917.patch text/plain 6659 dbates U3VidmVyc2lvbiBSZXZpc2lvbjogMTk2NDc2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggM2IyYzIwMDVjM2ZmZGZl NjQ0OWFmNTAyMWJjOTgwMWI5Zjc0MDc3Mi4uMGZjY2Y0ZWU4NWFjOTJhMTU4YjAxOWFjYmUwOWQx NjdmYjJlNGZmNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSw1ICsxLDI2IEBACiAyMDE2LTAyLTEyICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KIAorICAgICAgICBDU1A6ICdzYW5kYm94JyBz aG91bGQgYmUgaWdub3JlZCBpbiByZXBvcnQtb25seSBtb2RlCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTMxNjcKKyAgICAgICAgPHJkYXI6Ly9wcm9i bGVtLzIyNzA4NjY5PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIE1lcmdlZCBmcm9tIEJsaW5rIChwYXRjaCBieSBNaWtlIFdlc3QpOgorICAgICAgICA8 aHR0cHM6Ly9zcmMuY2hyb21pdW0ub3JnL3ZpZXd2Yy9ibGluaz9yZXZpc2lvbj0xNjUzMjImdmll dz1yZXZpc2lvbj4KKworICAgICAgICAqIHBhZ2UvY3NwL0NvbnRlbnRTZWN1cml0eVBvbGljeS5j cHA6CisgICAgICAgIChXZWJDb3JlOjpDb250ZW50U2VjdXJpdHlQb2xpY3k6OnJlcG9ydEludmFs aWREaXJlY3RpdmVJblJlcG9ydE9ubHlNb2RlKTogQWRkZWQuIExvZ3MgYQorICAgICAgICBjb25z b2xlIG1lc3NhZ2UgdG8gdGhlIGNvbnNvbGUgdG8gZXhwbGFpbiB0aGF0IHRoZSBzcGVjaWZpZWQg ZGlyZWN0aXZlIGlzIGludmFsaWQgaW4KKyAgICAgICAgcmVwb3J0LW9ubHkgbW9kZS4KKyAgICAg ICAgKiBwYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3kuaDoKKyAgICAgICAgKiBwYWdlL2Nz cC9Db250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0LmNwcDoKKyAgICAgICAgKFdlYkNv cmU6OkNvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZUxpc3Q6OmFwcGx5U2FuZGJveFBvbGlj eSk6IERvIG5vdCBhcHBseSBzYW5kYm94CisgICAgICAgIHBvbGljeSB3aGVuIGluIHJlcG9ydC1v bmx5IG1vZGUgYW5kIGNhbGwgQ29udGVudFNlY3VyaXR5UG9saWN5OjpyZXBvcnRJbnZhbGlkRGly ZWN0aXZlSW5SZXBvcnRPbmx5TW9kZSgpCisgICAgICAgIHRvIGxvZyBhIG1lc3NhZ2UgdG8gdGhl IGNvbnNvbGUuCisKKzIwMTYtMDItMTIgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUuY29t PgorCiAgICAgICAgIENTUDogQWxsb3cgc2NoZW1lbGVzcyBzb3VyY2UgZXhwcmVzc2lvbnMgdG8g bWF0Y2ggYW4gSFRUUCBvciBIVFRQUyByZXNvdXJjZQogICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU0MTc3CiAgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8y MjcwODc3Mj4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvY3NwL0NvbnRlbnRTZWN1 cml0eVBvbGljeS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQ b2xpY3kuY3BwCmluZGV4IGFkNGRmNDI1MTEwODliNjAwZjlhNzU4M2I0NzE1MzZiN2M0NmU2MzIu LmFjNjJlMzQzZjc1OGIxZTQ1M2UwNDZhMzQ4YmMxZTlhYmY3ZGExYTkgMTAwNjQ0Ci0tLSBhL1Nv dXJjZS9XZWJDb3JlL3BhZ2UvY3NwL0NvbnRlbnRTZWN1cml0eVBvbGljeS5jcHAKKysrIGIvU291 cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5LmNwcApAQCAtNDQ3LDYg KzQ0NywxMSBAQCB2b2lkIENvbnRlbnRTZWN1cml0eVBvbGljeTo6cmVwb3J0SW52YWxpZFJlZmxl Y3RlZFhTUyhjb25zdCBTdHJpbmcmIGludmFsaWRWYWx1ZQogICAgIGxvZ1RvQ29uc29sZSgiVGhl ICdyZWZsZWN0ZWQteHNzJyBDb250ZW50IFNlY3VyaXR5IFBvbGljeSBkaXJlY3RpdmUgaGFzIHRo ZSBpbnZhbGlkIHZhbHVlIFwiIiArIGludmFsaWRWYWx1ZSArICJcIi4gVmFsdWUgdmFsdWVzIGFy ZSBcImFsbG93XCIsIFwiZmlsdGVyXCIsIGFuZCBcImJsb2NrXCIuIik7CiB9CiAKK3ZvaWQgQ29u dGVudFNlY3VyaXR5UG9saWN5OjpyZXBvcnRJbnZhbGlkRGlyZWN0aXZlSW5SZXBvcnRPbmx5TW9k ZShjb25zdCBTdHJpbmcmIGRpcmVjdGl2ZU5hbWUpIGNvbnN0Cit7CisgICAgbG9nVG9Db25zb2xl KCJUaGUgQ29udGVudCBTZWN1cml0eSBQb2xpY3kgZGlyZWN0aXZlICciICsgZGlyZWN0aXZlTmFt ZSArICInIGlzIGlnbm9yZWQgd2hlbiBkZWxpdmVyZWQgaW4gYSByZXBvcnQtb25seSBwb2xpY3ku Iik7Cit9CisKIHZvaWQgQ29udGVudFNlY3VyaXR5UG9saWN5OjpyZXBvcnRJbnZhbGlkRGlyZWN0 aXZlVmFsdWVDaGFyYWN0ZXIoY29uc3QgU3RyaW5nJiBkaXJlY3RpdmVOYW1lLCBjb25zdCBTdHJp bmcmIHZhbHVlKSBjb25zdAogewogICAgIFN0cmluZyBtZXNzYWdlID0gbWFrZVN0cmluZygiVGhl IHZhbHVlIGZvciBDb250ZW50IFNlY3VyaXR5IFBvbGljeSBkaXJlY3RpdmUgJyIsIGRpcmVjdGl2 ZU5hbWUsICInIGNvbnRhaW5zIGFuIGludmFsaWQgY2hhcmFjdGVyOiAnIiwgdmFsdWUsICInLiBO b24td2hpdGVzcGFjZSBjaGFyYWN0ZXJzIG91dHNpZGUgQVNDSUkgMHgyMS0weDdFIG11c3QgYmUg cGVyY2VudC1lbmNvZGVkLCBhcyBkZXNjcmliZWQgaW4gUkZDIDM5ODYsIHNlY3Rpb24gMi4xOiBo dHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmMzOTg2I3NlY3Rpb24tMi4xLiIpOwpkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5LmggYi9T b3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3kuaAppbmRleCA2Mzcz YTAyZTkxZDQ2OTkxMTNiNGNiMzU2M2IzYjc3YWMyNzk2YTBiLi44ZGU3ZDY1MGUyMDZiNThhNThh MmFkODAzZTczYTE0MTMyMjE3MmFhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2Nz cC9Db250ZW50U2VjdXJpdHlQb2xpY3kuaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9D b250ZW50U2VjdXJpdHlQb2xpY3kuaApAQCAtMTIxLDYgKzEyMSw3IEBAIHB1YmxpYzoKICAgICB2 b2lkIHJlcG9ydEludmFsaWREaXJlY3RpdmVWYWx1ZUNoYXJhY3Rlcihjb25zdCBTdHJpbmcmIGRp cmVjdGl2ZU5hbWUsIGNvbnN0IFN0cmluZyYgdmFsdWUpIGNvbnN0OwogICAgIHZvaWQgcmVwb3J0 SW52YWxpZFNhbmRib3hGbGFncyhjb25zdCBTdHJpbmcmKSBjb25zdDsKICAgICB2b2lkIHJlcG9y dEludmFsaWRSZWZsZWN0ZWRYU1MoY29uc3QgU3RyaW5nJikgY29uc3Q7CisgICAgdm9pZCByZXBv cnRJbnZhbGlkRGlyZWN0aXZlSW5SZXBvcnRPbmx5TW9kZShjb25zdCBTdHJpbmcmKSBjb25zdDsK ICAgICB2b2lkIHJlcG9ydE1pc3NpbmdSZXBvcnRVUkkoY29uc3QgU3RyaW5nJikgY29uc3Q7CiAg ICAgdm9pZCByZXBvcnRVbnN1cHBvcnRlZERpcmVjdGl2ZShjb25zdCBTdHJpbmcmKSBjb25zdDsK ICAgICB2b2lkIHJlcG9ydFZpb2xhdGlvbihjb25zdCBTdHJpbmcmIGRpcmVjdGl2ZVRleHQsIGNv bnN0IFN0cmluZyYgZWZmZWN0aXZlRGlyZWN0aXZlLCBjb25zdCBTdHJpbmcmIGNvbnNvbGVNZXNz YWdlLCBjb25zdCBVUkwmIGJsb2NrZWRVUkwsIGNvbnN0IFZlY3RvcjxTdHJpbmc+JiByZXBvcnRV UklzLCBjb25zdCBTdHJpbmcmIGhlYWRlciwgY29uc3QgU3RyaW5nJiBjb250ZXh0VVJMID0gU3Ry aW5nKCksIGNvbnN0IFdURjo6T3JkaW5hbE51bWJlciYgY29udGV4dExpbmUgPSBXVEY6Ok9yZGlu YWxOdW1iZXI6OmJlZm9yZUZpcnN0KCksIEpTQzo6RXhlY1N0YXRlKiA9IG51bGxwdHIpIGNvbnN0 OwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9s aWN5RGlyZWN0aXZlTGlzdC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2Vj dXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0LmNwcAppbmRleCAzMmM0YTIwYzAwODIwN2RhMDVjNjQ0 YWNlZDBkMzM5NTVmYWI5MzI5Li5lNTYyNzdiYTNjNGQ2YmE1ZWM3YmY5YTAzOWNiYTA0NTY3N2Jj YjE2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQ b2xpY3lEaXJlY3RpdmVMaXN0LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250 ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0LmNwcApAQCAtNDkwLDYgKzQ5MCwxMCBAQCB2 b2lkIENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZUxpc3Q6OnNldENTUERpcmVjdGl2ZShj b25zdCBTdHJpbmcmIG5hbWUsIGNvbgogCiB2b2lkIENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVj dGl2ZUxpc3Q6OmFwcGx5U2FuZGJveFBvbGljeShjb25zdCBTdHJpbmcmIG5hbWUsIGNvbnN0IFN0 cmluZyYgc2FuZGJveFBvbGljeSkKIHsKKyAgICBpZiAobV9yZXBvcnRPbmx5KSB7CisgICAgICAg IG1fcG9saWN5LnJlcG9ydEludmFsaWREaXJlY3RpdmVJblJlcG9ydE9ubHlNb2RlKG5hbWUpOwor ICAgICAgICByZXR1cm47CisgICAgfQogICAgIGlmIChtX2hhdmVTYW5kYm94UG9saWN5KSB7CiAg ICAgICAgIG1fcG9saWN5LnJlcG9ydER1cGxpY2F0ZURpcmVjdGl2ZShuYW1lKTsKICAgICAgICAg cmV0dXJuOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCmluZGV4IDcyMTI0NGUyY2NlOWZlZTkxMDE3MWJjNjczMzljMDI0MTk3ZGRiOTcu LjVjYTRjYTMxZTI4YWUwNTNiMzI3OTM2ODJmNTE0NThjZDM0YWMxZGMgMTAwNjQ0Ci0tLSBhL0xh eW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsNSAr MSwxOCBAQAogMjAxNi0wMi0xMiAgRGFuaWVsIEJhdGVzICA8ZGFiYXRlc0BhcHBsZS5jb20+CiAK KyAgICAgICAgQ1NQOiAnc2FuZGJveCcgc2hvdWxkIGJlIGlnbm9yZWQgaW4gcmVwb3J0LW9ubHkg bW9kZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUz MTY3CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8yMjcwODY2OT4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBSZW1vdmUgdGhlIGVudHJ5IGZyb20gdGhl IFRlc3RFeHBlY3RhdGlvbnMgZmlsZSBmb3IgdGhlIHRlc3QKKyAgICAgICAgaHR0cC90ZXN0cy9z ZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvc2FuZGJveC1yZXBvcnQtb25seS5odG1sIGFz IGl0IG5vdyBwYXNzZXMuCisKKyAgICAgICAgKiBUZXN0RXhwZWN0YXRpb25zOgorCisyMDE2LTAy LTEyICBEYW5pZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKwogICAgICAgICBDU1A6IEFs bG93IHNjaGVtZWxlc3Mgc291cmNlIGV4cHJlc3Npb25zIHRvIG1hdGNoIGFuIEhUVFAgb3IgSFRU UFMgcmVzb3VyY2UKICAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE1NDE3NwogICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjI3MDg3NzI+CmRpZmYgLS1naXQg YS9MYXlvdXRUZXN0cy9UZXN0RXhwZWN0YXRpb25zIGIvTGF5b3V0VGVzdHMvVGVzdEV4cGVjdGF0 aW9ucwppbmRleCBmNTYzZmJlMmU4NGM4ZTEzYmRlOWQ1NmM5YmE3Nzk0NDIyOWQwMzE3Li40MzEw NTY5ZmI1ZWQ2MWVlN2EwMmVhODg4MjhjYWEzNzJmYTcyZjE2IDEwMDY0NAotLS0gYS9MYXlvdXRU ZXN0cy9UZXN0RXhwZWN0YXRpb25zCisrKyBiL0xheW91dFRlc3RzL1Rlc3RFeHBlY3RhdGlvbnMK QEAgLTgyNyw3ICs4MjcsNiBAQCB3ZWJraXQub3JnL2IvMTUzMTY2IGh0dHAvdGVzdHMvc2VjdXJp dHkvY29udGVudFNlY3VyaXR5UG9saWN5L3JlcG9ydC11cmktZnJvbS1qYQogd2Via2l0Lm9yZy9i LzE1MzE2NiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXBvcnQt dXJpLmh0bWwgWyBGYWlsdXJlIF0KIHdlYmtpdC5vcmcvYi8xNTMxNjYgd2Via2l0Lm9yZy9iLzE1 MzI0MiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9yZXBvcnQtYW5k LWVuZm9yY2UuaHRtbCBbIEZhaWx1cmUgXQogd2Via2l0Lm9yZy9iLzE1MzE2NiB3ZWJraXQub3Jn L2IvMTUzMjQyIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3JlcG9y dC1ibG9ja2VkLWRhdGEtdXJpLmh0bWwgWyBGYWlsdXJlIF0KLXdlYmtpdC5vcmcvYi8xNTMxNjcg aHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvc2FuZGJveC1yZXBvcnQt b25seS5odG1sIFsgRmFpbHVyZSBdCiB3ZWJraXQub3JnL2IvMTUzMTY4IGh0dHAvdGVzdHMvc2Vj dXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NvdXJjZS1saXN0LXBhcnNpbmctMDcuaHRtbCBb IEZhaWx1cmUgXQogd2Via2l0Lm9yZy9iLzE1MzE3MCBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRl bnRTZWN1cml0eVBvbGljeS9zb3VyY2UtbGlzdC1wYXJzaW5nLXBhdGhzLTAzLmh0bWwgWyBGYWls dXJlIF0KIHdlYmtpdC5vcmcvYi8xNTM1NjIgaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2Vj dXJpdHlQb2xpY3kvd29ya2VyLXNjcmlwdC1zcmMuaHRtbCBbIEZhaWx1cmUgXQo=