154555 2016-02-22 13:44:31 -0800 REGRESSION (r196892): No longer emit error message when CSP form-action directive is used as a source expression 2016-02-23 13:32:52 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Local Build All All RESOLVED FIXED data:text/html,<!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="script-src 'self' form-action 'self'"></head></html> InRadar P2 Normal --- 154520 1 dbates dbates aestes bfulgham commit-queue mkwst webkit-bug-importer oldest_to_newest 1167178 0 dbates 2016-02-22 13:44:31 -0800 Suppose a page has the following HTML meta element with malformed Content Security Policy: <meta http-equiv="Content-Security-Policy" content="script-src 'self' form-action 'self'"> Then we show a console error of the form: [Error] The Content Security Policy directive 'script-src' contains 'form-action' as a source expression. Did you mean 'script-src ...; form-action...' (note the semicolon)? But we no longer emit this console error following <http://trac.webkit.org/changeset/196892> (bug #154520). 1167179 1 webkit-bug-importer 2016-02-22 13:45:00 -0800 <rdar://problem/24776777> 1167180 2 271953 dbates 2016-02-22 13:54:35 -0800 Created attachment 271953 Patch and Layout Test 1167518 3 271953 dbates 2016-02-23 13:32:49 -0800 Comment on attachment 271953 Patch and Layout Test Clearing flags on attachment: 271953 Committed r196992: <http://trac.webkit.org/changeset/196992> 1167519 4 dbates 2016-02-23 13:32:52 -0800 All reviewed patches have been landed. Closing bug. 271953 2016-02-22 13:54:35 -0800 2016-02-23 13:32:49 -0800 Patch and Layout Test bug-154555-20160222135417.patch text/plain 5670 dbates U3VidmVyc2lvbiBSZXZpc2lvbjogMTk2ODg1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZmY5ZWM4ZWZkZTdjYTUw OGZjYjdmYjhmZDk0Y2FiMTQ2YzI0ZGU2Ny4uNjkyYjRlYzZjOGVlYjY1NTJiM2M0Njc5NWU4NDky OGZkOTJjNjIzOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDE2LTAyLTIyICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMTk2 ODkyKTogTm8gbG9uZ2VyIGVtaXQgZXJyb3IgbWVzc2FnZSB3aGVuIENTUCBmb3JtLWFjdGlvbiBk aXJlY3RpdmUgaXMgdXNlZCBhcyBhIHNvdXJjZSBleHByZXNzaW9uCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTQ1NTUKKyAgICAgICAgPHJkYXI6Ly9w cm9ibGVtLzI0Nzc2Nzc3PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIEZpeGVzIGFuIGlzc3VlIHdoZXJlIGFuIGVycm9yIG1lc3NhZ2UgaXMgbm90IGVt aXR0ZWQgd2hlbiBkaXJlY3RpdmUgZm9ybS1hY3Rpb24gaXMgdXNlZCBhcyBhCisgICAgICAgIHNv dXJjZSBleHByZXNzaW9uLiBQcmlvciB0byA8aHR0cDovL3RyYWMud2Via2l0Lm9yZy9jaGFuZ2Vz ZXQvMTk2ODkyPiwgd2hlbiBkaXJlY3RpdmUgZm9ybS1hY3Rpb24KKyAgICAgICAgd2FzIHVzZWQg YXMgYSBzb3VyY2UgZXhwcmVzc2lvbiBhIGNvbnNvbGUgZXJyb3IgbWVzc2FnZSB3b3VsZCBiZSBl bWl0dGVkIHdpdGggdGhlIGZvcm06CisKKyAgICAgICAgICAgIFRoZSBDb250ZW50IFNlY3VyaXR5 IFBvbGljeSBkaXJlY3RpdmUgJ3NjcmlwdC1zcmMnIGNvbnRhaW5zICdmb3JtLWFjdGlvbicgYXMg YSBzb3VyY2UgZXhwcmVzc2lvbi4KKyAgICAgICAgICAgIERpZCB5b3UgbWVhbiAnc2NyaXB0LXNy YyAuLi47IGZvcm0tYWN0aW9uLi4uJyAobm90ZSB0aGUgc2VtaWNvbG9uKT8KKworICAgICAgICAq IHBhZ2UvY3NwL0NvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZUxpc3QuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6aXNDU1BEaXJlY3RpdmVOYW1lKTogUmV0dXJuIHRydWUgaWYgdGhlIHNwZWNp ZmllZCBkaXJlY3RpdmUgbmFtZSBpcyAiZm9ybS1hY3Rpb24iLgorCiAyMDE2LTAyLTIxICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KIAogICAgICAgICBDU1A6IFZpb2xhdGlvbiBy ZXBvcnQgc2hvdWxkIGluY2x1ZGUgY29sdW1uIG51bWJlcgpkaWZmIC0tZ2l0IGEvU291cmNlL1dl YkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZlTGlzdC5jcHAgYi9T b3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0 LmNwcAppbmRleCBiYWZmZmFjNTRhM2FlMmM1Y2I4MzI0NmFhZDFmOWU0MDVhYTRmMGQ2Li5jMmEx MzdmNGNkODY5NjIwYTdjMWMwOTUyNmViZjQ0ODJjZWE5MTc3IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0LmNwcAor KysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3Rp dmVMaXN0LmNwcApAQCAtNzksNiArNzksNyBAQCBib29sIGlzQ1NQRGlyZWN0aXZlTmFtZShjb25z dCBTdHJpbmcmIG5hbWUpCiAgICAgcmV0dXJuIGVxdWFsTGV0dGVyc0lnbm9yaW5nQVNDSUlDYXNl KG5hbWUsIGNvbm5lY3RTcmMpCiAgICAgICAgIHx8IGVxdWFsTGV0dGVyc0lnbm9yaW5nQVNDSUlD YXNlKG5hbWUsIGRlZmF1bHRTcmMpCiAgICAgICAgIHx8IGVxdWFsTGV0dGVyc0lnbm9yaW5nQVND SUlDYXNlKG5hbWUsIGZvbnRTcmMpCisgICAgICAgIHx8IGVxdWFsTGV0dGVyc0lnbm9yaW5nQVND SUlDYXNlKG5hbWUsIGZvcm1BY3Rpb24pCiAgICAgICAgIHx8IGVxdWFsTGV0dGVyc0lnbm9yaW5n QVNDSUlDYXNlKG5hbWUsIGZyYW1lU3JjKQogICAgICAgICB8fCBlcXVhbExldHRlcnNJZ25vcmlu Z0FTQ0lJQ2FzZShuYW1lLCBpbWdTcmMpCiAgICAgICAgIHx8IGVxdWFsTGV0dGVyc0lnbm9yaW5n QVNDSUlDYXNlKG5hbWUsIG1lZGlhU3JjKQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdl TG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGJjM2FhMDZiMTQxYmJhOWI0YTFlZmU4 YTExMzgwZjY0M2E2MzVkM2IuLjhmZmM4YjRjNTBiMWFjZDcxZDI4MWE4YzdlZmYzNmU0NjM2YjI4 YTEgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cKQEAgLTEsMyArMSwxOCBAQAorMjAxNi0wMi0yMiAgRGFuaWVsIEJhdGVzICA8ZGFi YXRlc0BhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTiAocjE5Njg5Mik6IE5vIGxvbmdl ciBlbWl0IGVycm9yIG1lc3NhZ2Ugd2hlbiBDU1AgZm9ybS1hY3Rpb24gZGlyZWN0aXZlIGlzIHVz ZWQgYXMgYSBzb3VyY2UgZXhwcmVzc2lvbgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTU0NTU1CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8yNDc3Njc3 Nz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0 IHRoYXQgd2UgZW1pdCBhIGNvbnNvbGUgZXJyb3IgbWVzc2FnZSB3aGVuIGZvcm0tYWN0aW9uIGlz IHVzZWQgYXMgYSBzb3VyY2UgZXhwcmVzc2lvbi4KKworICAgICAgICAqIGh0dHAvdGVzdHMvc2Vj dXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NvdXJjZS1saXN0LXBhcnNpbmctbm8tc2VtaWNv bG9uLWV4cGVjdGVkLnR4dDoKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRT ZWN1cml0eVBvbGljeS9zb3VyY2UtbGlzdC1wYXJzaW5nLW5vLXNlbWljb2xvbi5odG1sOiBVc2Ug Zm9ybS1hY3Rpb24gYXMgYQorICAgICAgICBzb3VyY2UgZXhwcmVzc2lvbi4gQWxzbywgdXNlIGEg ZG91YmxlIHF1b3RlZCAoIikgc3RyaW5nIGxpdGVyYWwgaW5zdGVhZCBvZiBhIHNpbmdsZSBxdW90 ZWQgKCcpIHN0cmluZworICAgICAgICBsaXRlcmFsIHRvIHJlcHJlc2VudCB0aGUgQ1NQIHBvbGlj eSBzbyBhcyB0byBhdm9pZCB0aGUgbmVlZCB0byBlc2NhcGUgZW1iZWRkZWQgc2luZ2xlIHF1b3Rl IGNoYXJhY3RlcnMuCisKIDIwMTYtMDItMjEgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUu Y29tPgogCiAgICAgICAgIENTUDogc2FuZGJveCBkaXJlY3RpdmUgc2hvdWxkIGJlIGlnbm9yZWQg d2hlbiBjb250YWluZWQgaW4gYSBwb2xpY3kgZGVmaW5lZCB2aWEgYSBtZXRhIGVsZW1lbnQKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5 UG9saWN5L3NvdXJjZS1saXN0LXBhcnNpbmctbm8tc2VtaWNvbG9uLWV4cGVjdGVkLnR4dCBiL0xh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NvdXJj ZS1saXN0LXBhcnNpbmctbm8tc2VtaWNvbG9uLWV4cGVjdGVkLnR4dAppbmRleCA1MGU2NjIzYWI4 YWQ3OGM5MDIzNTQ2OTJhNjk5OTA2Nzg3ZDNkZTBiLi4yMzhiZDE1ZTY5ZWFiNTFmYjg4NGUzYjhj NjE3MjJhMjY0YWIyMDY5IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3Vy aXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9zb3VyY2UtbGlzdC1wYXJzaW5nLW5vLXNlbWljb2xv bi1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9jb250 ZW50U2VjdXJpdHlQb2xpY3kvc291cmNlLWxpc3QtcGFyc2luZy1uby1zZW1pY29sb24tZXhwZWN0 ZWQudHh0CkBAIC0xLDYgKzEsNyBAQAogQ09OU09MRSBNRVNTQUdFOiBUaGUgQ29udGVudCBTZWN1 cml0eSBQb2xpY3kgZGlyZWN0aXZlICdkZWZhdWx0LXNyYycgY29udGFpbnMgJ3NjcmlwdC1zcmMn IGFzIGEgc291cmNlIGV4cHJlc3Npb24uIERpZCB5b3UgbWVhbiAnZGVmYXVsdC1zcmMgLi4uOyBz Y3JpcHQtc3JjLi4uJyAobm90ZSB0aGUgc2VtaWNvbG9uKT8KIENPTlNPTEUgTUVTU0FHRTogVGhl IENvbnRlbnQgU2VjdXJpdHkgUG9saWN5IGRpcmVjdGl2ZSAnc2NyaXB0LXNyYycgY29udGFpbnMg J29iamVjdC1zcmMnIGFzIGEgc291cmNlIGV4cHJlc3Npb24uIERpZCB5b3UgbWVhbiAnc2NyaXB0 LXNyYyAuLi47IG9iamVjdC1zcmMuLi4nIChub3RlIHRoZSBzZW1pY29sb24pPwogQ09OU09MRSBN RVNTQUdFOiBUaGUgQ29udGVudCBTZWN1cml0eSBQb2xpY3kgZGlyZWN0aXZlICdzY3JpcHQtc3Jj JyBjb250YWlucyAnc3R5bGUtc3JjJyBhcyBhIHNvdXJjZSBleHByZXNzaW9uLiBEaWQgeW91IG1l YW4gJ3NjcmlwdC1zcmMgLi4uOyBzdHlsZS1zcmMuLi4nIChub3RlIHRoZSBzZW1pY29sb24pPwor Q09OU09MRSBNRVNTQUdFOiBUaGUgQ29udGVudCBTZWN1cml0eSBQb2xpY3kgZGlyZWN0aXZlICdz Y3JpcHQtc3JjJyBjb250YWlucyAnZm9ybS1hY3Rpb24nIGFzIGEgc291cmNlIGV4cHJlc3Npb24u IERpZCB5b3UgbWVhbiAnc2NyaXB0LXNyYyAuLi47IGZvcm0tYWN0aW9uLi4uJyAobm90ZSB0aGUg c2VtaWNvbG9uKT8KIElmIGEgd2ViIGF1dGhvciBmb3JnZXRzIGEgc2VtaWNvbG9uLCB3ZSBzaG91 bGQgZG8gb3VyIGJlc3QgdG8gd2FybiB0aGVtIHRoYXQgdGhlIHBvbGljeSB0aGV5J3ZlIGRlZmlu ZWQgaXMgcHJvYmFibHkgbm90IHdoYXQgdGhleSBpbnRlbmRlZC4KIAogCmRpZmYgLS1naXQgYS9M YXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9zb3Vy Y2UtbGlzdC1wYXJzaW5nLW5vLXNlbWljb2xvbi5odG1sIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvc291cmNlLWxpc3QtcGFyc2luZy1uby1z ZW1pY29sb24uaHRtbAppbmRleCBiY2E1NjgxYjljMGJlYWIwNWI4ZjE1YzQ3YzUwMTg3NmIwMDg3 MzYyLi4xOWZkN2EwOTY2MmQwYmMyNjk0OTI5MDA3ZDk4ZGNhNmQzMjIwZjZkIDEwMDY0NAotLS0g YS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9z b3VyY2UtbGlzdC1wYXJzaW5nLW5vLXNlbWljb2xvbi5odG1sCisrKyBiL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NvdXJjZS1saXN0LXBhcnNp bmctbm8tc2VtaWNvbG9uLmh0bWwKQEAgLTUsNyArNSw3IEBACiA8c2NyaXB0PgogdmFyIHRlc3Rz ID0gWwogICAgIFsneWVzJywgJ2RlZmF1bHQtc3JjIFwnc2VsZlwnIHNjcmlwdC1zcmMgZXhhbXBs ZS5jb20nLCAncmVzb3VyY2VzL3NjcmlwdC5qcyddLAotICAgIFsneWVzJywgJ3NjcmlwdC1zcmMg XCdzZWxmXCcgb2JqZWN0LXNyYyBcJ3NlbGZcJyBzdHlsZS1zcmMgKicsICdyZXNvdXJjZXMvc2Ny aXB0LmpzJ10sCisgICAgWyd5ZXMnLCAic2NyaXB0LXNyYyAnc2VsZicgb2JqZWN0LXNyYyAnc2Vs Zicgc3R5bGUtc3JjICogZm9ybS1hY3Rpb24gJ3NlbGYnIiwgJ3Jlc291cmNlcy9zY3JpcHQuanMn XSwKIF07CiA8L3NjcmlwdD4KIDwvaGVhZD4K