185364 2018-05-06 12:33:33 -0700 CSP should only notify Inspector to pause the debugger on the first policy to violate a directive 2018-05-07 10:43:01 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Local Build All All RESOLVED FIXED InRadar P2 Normal --- 1 dbates dbates bfulgham ews-watchlist joepeck mkwst webkit-bug-importer oldest_to_newest 1421152 0 dbates 2018-05-06 12:33:33 -0700 It seems sufficient to tell Web Inspector that a script was blocked once for the first enforced CSP policy that it violated. Currently we tell Web Inspector that a script was blocked for each enforced CSP policy that it violated. When Web Inspector is notified of a CSP blocked script it pauses script execution. It does not seem very meaningful from a developer's perspective to have Web Inspector pause script execution for the same script because it violated more than one enforced CSP policy. Pausing once with the CSP violation text should provide enough insight for a developer to check all their CSP policies. For completeness, a page can have more than one Content Security Policy if either its HTTP response has more than one Content-Security-Policy HTTP header or it has multiple <meta http-equiv="Content-Security-Policy"> elements (or both). 1421154 1 339689 dbates 2018-05-06 12:39:52 -0700 Created attachment 339689 Patch 1421157 2 339689 bfulgham 2018-05-06 13:16:51 -0700 Comment on attachment 339689 Patch Good idea! r=me 1421324 3 339689 dbates 2018-05-07 10:41:55 -0700 Comment on attachment 339689 Patch Clearing flags on attachment: 339689 Committed r231443: <https://trac.webkit.org/changeset/231443> 1421325 4 dbates 2018-05-07 10:41:57 -0700 All reviewed patches have been landed. Closing bug. 1421329 5 webkit-bug-importer 2018-05-07 10:43:01 -0700 <rdar://problem/40027826> 339689 2018-05-06 12:39:52 -0700 2018-05-07 10:41:55 -0700 Patch bug-185364-20180506123952.patch text/plain 6914 dbates U3VidmVyc2lvbiBSZXZpc2lvbjogMjMxMzk0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMjkzY2NmMGI2YjIxZmQ4 YzZmMWMwMmI4MDhkOWY4MTA5NGI0N2E5YS4uNDBhODIxZDZkNzIxNDMwMjQ2OWYyYzQ2NjY2NjMw M2IyNjhhZjg5NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE4LTA1LTA2ICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKworICAgICAgICBDU1Agc2hvdWxkIG9ubHkg bm90aWZ5IEluc3BlY3RvciB0byBwYXVzZSB0aGUgZGVidWdnZXIgb24gdGhlIGZpcnN0IHBvbGlj eSB0byB2aW9sYXRlIGEgZGlyZWN0aXZlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xODUzNjQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBOb3RpZnkgV2ViIEluc3BlY3RvciB0aGF0IGEgc2NyaXB0IHdhcyBi bG9ja2VkIG9uIHRoZSBmaXJzdCBlbmZvcmNlZCBDU1AgcG9saWN5IHRoYXQgaXQKKyAgICAgICAg dmlvbGF0ZXMuCisKKyAgICAgICAgQSBwYWdlIGNhbiBoYXZlIG1vcmUgdGhhbiBvbmUgZW5mb3Jj ZWQgQ29udGVudCBTZWN1cml0eSBQb2xpY3kuIEN1cnJlbnRseSBmb3IgaW5saW5lCisgICAgICAg IHNjcmlwdHMsIGlubGluZSBldmVudCBoYW5kbGVycywgSmF2YVNjcmlwdCBVUkxzLCBhbmQgZXZh bCgpIHRoYXQgYXJlIGJsb2NrZWQgYnkgQ1NQCisgICAgICAgIHdlIG5vdGlmeSBXZWIgSW5zcGVj dG9yIHRoYXQgaXQgd2FzIGJsb2NrZWQgZm9yIGVhY2ggQ1NQIHBvbGljeSB0aGF0IGJsb2NrZWQg aXQuIFdoZW4KKyAgICAgICAgV2ViIEluc3BlY3RvciBpcyBub3RpZmllZCBpdCBwYXVzZXMgc2Ny aXB0IGV4ZWN1dGlvbi4gSXQgZG9lcyBub3Qgc2VlbSB2ZXJ5IG1lYW5pbmdmdWwKKyAgICAgICAg dG8gcGF1c2Ugc2NyaXB0IGV4ZWN1dGlvbiBvbiB0aGUgc2FtZSBzY3JpcHQgZm9yIGVhY2ggQ1NQ IHBvbGljeSB0aGF0IGJsb2NrZWQgaXQuCisgICAgICAgIFRoZXJlZm9yZSwgb25seSB0ZWxsIFdl YiBJbnNwZWN0b3IgdGhhdCBhIHNjcmlwdCB3YXMgYmxvY2tlZCBmb3IgdGhlIGZpcnN0IGVuZm9y Y2VkIENTUAorICAgICAgICBwb2xpY3kgdGhhdCBibG9ja2VkIGl0LgorCisgICAgICAgICogcGFn ZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNvbnRl bnRTZWN1cml0eVBvbGljeTo6YWxsb3dKYXZhU2NyaXB0VVJMcyBjb25zdCk6CisgICAgICAgIChX ZWJDb3JlOjpDb250ZW50U2VjdXJpdHlQb2xpY3k6OmFsbG93SW5saW5lRXZlbnRIYW5kbGVycyBj b25zdCk6CisgICAgICAgIChXZWJDb3JlOjpDb250ZW50U2VjdXJpdHlQb2xpY3k6OmFsbG93SW5s aW5lU2NyaXB0IGNvbnN0KToKKyAgICAgICAgKFdlYkNvcmU6OkNvbnRlbnRTZWN1cml0eVBvbGlj eTo6YWxsb3dFdmFsIGNvbnN0KToKKwogMjAxOC0wNS0wMiAgRGVhbiBKYWNrc29uICA8ZGlub0Bh cHBsZS5jb20+CiAKICAgICAgICAgVXNlIElPU3VyZmFjZXMgZm9yIENvcmVJbWFnZSBvcGVyYXRp b25zIHdoZXJlIHBvc3NpYmxlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9D b250ZW50U2VjdXJpdHlQb2xpY3kuY3BwIGIvU291cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVu dFNlY3VyaXR5UG9saWN5LmNwcAppbmRleCBhNzc1YjBiMTk5MDI1N2ExMWQxODNjMjEzMDI5OGIy ZTE3YjQ3YmQ0Li43YjJmZjBlZjhhNjZmZTQ1ZTYzYWY1YWIxOGNjZjFmMTY1NGMwZjMwIDEwMDY0 NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xpY3kuY3Bw CisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvY3NwL0NvbnRlbnRTZWN1cml0eVBvbGljeS5jcHAK QEAgLTM1MCwxMSArMzUwLDE0IEBAIGJvb2wgQ29udGVudFNlY3VyaXR5UG9saWN5OjphbGxvd0ph dmFTY3JpcHRVUkxzKGNvbnN0IFN0cmluZyYgY29udGV4dFVSTCwgY29uc3QKIHsKICAgICBpZiAo b3ZlcnJpZGVDb250ZW50U2VjdXJpdHlQb2xpY3kpCiAgICAgICAgIHJldHVybiB0cnVlOworICAg IGJvb2wgZGlkTm90aWZ5SW5zcGVjdG9yID0gZmFsc2U7CiAgICAgYXV0byBoYW5kbGVWaW9sYXRl ZERpcmVjdGl2ZSA9IFsmXSAoY29uc3QgQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZlJiB2 aW9sYXRlZERpcmVjdGl2ZSkgewogICAgICAgICBTdHJpbmcgY29uc29sZU1lc3NhZ2UgPSBjb25z b2xlTWVzc2FnZUZvclZpb2xhdGlvbihDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVOYW1l czo6c2NyaXB0U3JjLCB2aW9sYXRlZERpcmVjdGl2ZSwgVVJMKCksICJSZWZ1c2VkIHRvIGV4ZWN1 dGUgYSBzY3JpcHQiLCAiaXRzIGhhc2gsIGl0cyBub25jZSwgb3IgJ3Vuc2FmZS1pbmxpbmUnIik7 CiAgICAgICAgIHJlcG9ydFZpb2xhdGlvbihDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVO YW1lczo6c2NyaXB0U3JjLCB2aW9sYXRlZERpcmVjdGl2ZSwgVVJMKCksIGNvbnNvbGVNZXNzYWdl LCBjb250ZXh0VVJMLCBUZXh0UG9zaXRpb24oY29udGV4dExpbmUsIFdURjo6T3JkaW5hbE51bWJl cigpKSk7Ci0gICAgICAgIGlmICghdmlvbGF0ZWREaXJlY3RpdmUuZGlyZWN0aXZlTGlzdCgpLmlz UmVwb3J0T25seSgpKQorICAgICAgICBpZiAoIWRpZE5vdGlmeUluc3BlY3RvciAmJiB2aW9sYXRl ZERpcmVjdGl2ZS5kaXJlY3RpdmVMaXN0KCkuaXNSZXBvcnRPbmx5KCkpIHsKICAgICAgICAgICAg IHJlcG9ydEJsb2NrZWRTY3JpcHRFeGVjdXRpb25Ub0luc3BlY3Rvcih2aW9sYXRlZERpcmVjdGl2 ZS50ZXh0KCkpOworICAgICAgICAgICAgZGlkTm90aWZ5SW5zcGVjdG9yID0gdHJ1ZTsKKyAgICAg ICAgfQogICAgIH07CiAgICAgcmV0dXJuIGFsbFBvbGljaWVzQWxsb3coV1RGTW92ZShoYW5kbGVW aW9sYXRlZERpcmVjdGl2ZSksICZDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0Ojp2 aW9sYXRlZERpcmVjdGl2ZUZvclVuc2FmZUlubGluZVNjcmlwdCk7CiB9CkBAIC0zNjMsMTEgKzM2 NiwxNCBAQCBib29sIENvbnRlbnRTZWN1cml0eVBvbGljeTo6YWxsb3dJbmxpbmVFdmVudEhhbmRs ZXJzKGNvbnN0IFN0cmluZyYgY29udGV4dFVSTCwgYwogewogICAgIGlmIChvdmVycmlkZUNvbnRl bnRTZWN1cml0eVBvbGljeSkKICAgICAgICAgcmV0dXJuIHRydWU7CisgICAgYm9vbCBkaWROb3Rp ZnlJbnNwZWN0b3IgPSBmYWxzZTsKICAgICBhdXRvIGhhbmRsZVZpb2xhdGVkRGlyZWN0aXZlID0g WyZdIChjb25zdCBDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmUmIHZpb2xhdGVkRGlyZWN0 aXZlKSB7CiAgICAgICAgIFN0cmluZyBjb25zb2xlTWVzc2FnZSA9IGNvbnNvbGVNZXNzYWdlRm9y VmlvbGF0aW9uKENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZU5hbWVzOjpzY3JpcHRTcmMs IHZpb2xhdGVkRGlyZWN0aXZlLCBVUkwoKSwgIlJlZnVzZWQgdG8gZXhlY3V0ZSBhIHNjcmlwdCBm b3IgYW4gaW5saW5lIGV2ZW50IGhhbmRsZXIiLCAiJ3Vuc2FmZS1pbmxpbmUnIik7CiAgICAgICAg IHJlcG9ydFZpb2xhdGlvbihDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVOYW1lczo6c2Ny aXB0U3JjLCB2aW9sYXRlZERpcmVjdGl2ZSwgVVJMKCksIGNvbnNvbGVNZXNzYWdlLCBjb250ZXh0 VVJMLCBUZXh0UG9zaXRpb24oY29udGV4dExpbmUsIFdURjo6T3JkaW5hbE51bWJlcigpKSk7Ci0g ICAgICAgIGlmICghdmlvbGF0ZWREaXJlY3RpdmUuZGlyZWN0aXZlTGlzdCgpLmlzUmVwb3J0T25s eSgpKQorICAgICAgICBpZiAoIWRpZE5vdGlmeUluc3BlY3RvciAmJiAhdmlvbGF0ZWREaXJlY3Rp dmUuZGlyZWN0aXZlTGlzdCgpLmlzUmVwb3J0T25seSgpKSB7CiAgICAgICAgICAgICByZXBvcnRC bG9ja2VkU2NyaXB0RXhlY3V0aW9uVG9JbnNwZWN0b3IodmlvbGF0ZWREaXJlY3RpdmUudGV4dCgp KTsKKyAgICAgICAgICAgIGRpZE5vdGlmeUluc3BlY3RvciA9IHRydWU7CisgICAgICAgIH0KICAg ICB9OwogICAgIHJldHVybiBhbGxQb2xpY2llc0FsbG93KFdURk1vdmUoaGFuZGxlVmlvbGF0ZWRE aXJlY3RpdmUpLCAmQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZlTGlzdDo6dmlvbGF0ZWRE aXJlY3RpdmVGb3JVbnNhZmVJbmxpbmVTY3JpcHQpOwogfQpAQCAtMzk4LDYgKzQwNCw3IEBAIGJv b2wgQ29udGVudFNlY3VyaXR5UG9saWN5OjphbGxvd0lubGluZVNjcmlwdChjb25zdCBTdHJpbmcm IGNvbnRleHRVUkwsIGNvbnN0IFdUCiB7CiAgICAgaWYgKG92ZXJyaWRlQ29udGVudFNlY3VyaXR5 UG9saWN5KQogICAgICAgICByZXR1cm4gdHJ1ZTsKKyAgICBib29sIGRpZE5vdGlmeUluc3BlY3Rv ciA9IGZhbHNlOwogICAgIGJvb2wgZm91bmRIYXNoSW5FbmZvcmNlZFBvbGljaWVzOwogICAgIGJv b2wgZm91bmRIYXNoSW5SZXBvcnRPbmx5UG9saWNpZXM7CiAgICAgc3RkOjp0aWUoZm91bmRIYXNo SW5FbmZvcmNlZFBvbGljaWVzLCBmb3VuZEhhc2hJblJlcG9ydE9ubHlQb2xpY2llcykgPSBmaW5k SGFzaE9mQ29udGVudEluUG9saWNpZXMoJkNvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZUxp c3Q6OnZpb2xhdGVkRGlyZWN0aXZlRm9yU2NyaXB0SGFzaCwgc2NyaXB0Q29udGVudCwgbV9oYXNo QWxnb3JpdGhtc0ZvcklubGluZVNjcmlwdHMpOwpAQCAtNDA2LDggKzQxMywxMCBAQCBib29sIENv bnRlbnRTZWN1cml0eVBvbGljeTo6YWxsb3dJbmxpbmVTY3JpcHQoY29uc3QgU3RyaW5nJiBjb250 ZXh0VVJMLCBjb25zdCBXVAogICAgIGF1dG8gaGFuZGxlVmlvbGF0ZWREaXJlY3RpdmUgPSBbJl0g KGNvbnN0IENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZSYgdmlvbGF0ZWREaXJlY3RpdmUp IHsKICAgICAgICAgU3RyaW5nIGNvbnNvbGVNZXNzYWdlID0gY29uc29sZU1lc3NhZ2VGb3JWaW9s YXRpb24oQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZlTmFtZXM6OnNjcmlwdFNyYywgdmlv bGF0ZWREaXJlY3RpdmUsIFVSTCgpLCAiUmVmdXNlZCB0byBleGVjdXRlIGEgc2NyaXB0IiwgIml0 cyBoYXNoLCBpdHMgbm9uY2UsIG9yICd1bnNhZmUtaW5saW5lJyIpOwogICAgICAgICByZXBvcnRW aW9sYXRpb24oQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZlTmFtZXM6OnNjcmlwdFNyYywg dmlvbGF0ZWREaXJlY3RpdmUsIFVSTCgpLCBjb25zb2xlTWVzc2FnZSwgY29udGV4dFVSTCwgVGV4 dFBvc2l0aW9uKGNvbnRleHRMaW5lLCBXVEY6Ok9yZGluYWxOdW1iZXIoKSkpOwotICAgICAgICBp ZiAoIXZpb2xhdGVkRGlyZWN0aXZlLmRpcmVjdGl2ZUxpc3QoKS5pc1JlcG9ydE9ubHkoKSkKKyAg ICAgICAgaWYgKCFkaWROb3RpZnlJbnNwZWN0b3IgJiYgIXZpb2xhdGVkRGlyZWN0aXZlLmRpcmVj dGl2ZUxpc3QoKS5pc1JlcG9ydE9ubHkoKSkgewogICAgICAgICAgICAgcmVwb3J0QmxvY2tlZFNj cmlwdEV4ZWN1dGlvblRvSW5zcGVjdG9yKHZpb2xhdGVkRGlyZWN0aXZlLnRleHQoKSk7CisgICAg ICAgICAgICBkaWROb3RpZnlJbnNwZWN0b3IgPSB0cnVlOworICAgICAgICB9CiAgICAgfTsKICAg ICAvLyBGSVhNRTogV2Ugc2hvdWxkIG5vdCByZXBvcnQgdGhhdCB0aGUgaW5saW5lIHNjcmlwdCB2 aW9sYXRlZCBhIHBvbGljeSB3aGVuIGl0cyBoYXNoIG1hdGNoZWQgYSBzb3VyY2UKICAgICAvLyBl eHByZXNzaW9uIGluIHRoZSBwb2xpY3kgYW5kIHRoZSBwYWdlIGhhcyBtb3JlIHRoYW4gb25lIHBv bGljeS4gU2VlIDxodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU5ODMy Pi4KQEAgLTQ0MiwxMSArNDUxLDE0IEBAIGJvb2wgQ29udGVudFNlY3VyaXR5UG9saWN5OjphbGxv d0V2YWwoSlNDOjpFeGVjU3RhdGUqIHN0YXRlLCBib29sIG92ZXJyaWRlQ29udGVuCiB7CiAgICAg aWYgKG92ZXJyaWRlQ29udGVudFNlY3VyaXR5UG9saWN5KQogICAgICAgICByZXR1cm4gdHJ1ZTsK KyAgICBib29sIGRpZE5vdGlmeUluc3BlY3RvciA9IGZhbHNlOwogICAgIGF1dG8gaGFuZGxlVmlv bGF0ZWREaXJlY3RpdmUgPSBbJl0gKGNvbnN0IENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2 ZSYgdmlvbGF0ZWREaXJlY3RpdmUpIHsKICAgICAgICAgU3RyaW5nIGNvbnNvbGVNZXNzYWdlID0g Y29uc29sZU1lc3NhZ2VGb3JWaW9sYXRpb24oQ29udGVudFNlY3VyaXR5UG9saWN5RGlyZWN0aXZl TmFtZXM6OnNjcmlwdFNyYywgdmlvbGF0ZWREaXJlY3RpdmUsIFVSTCgpLCAiUmVmdXNlZCB0byBl eGVjdXRlIGEgc2NyaXB0IiwgIid1bnNhZmUtZXZhbCciKTsKICAgICAgICAgcmVwb3J0VmlvbGF0 aW9uKENvbnRlbnRTZWN1cml0eVBvbGljeURpcmVjdGl2ZU5hbWVzOjpzY3JpcHRTcmMsIHZpb2xh dGVkRGlyZWN0aXZlLCBVUkwoKSwgY29uc29sZU1lc3NhZ2UsIHN0YXRlKTsKLSAgICAgICAgaWYg KCF2aW9sYXRlZERpcmVjdGl2ZS5kaXJlY3RpdmVMaXN0KCkuaXNSZXBvcnRPbmx5KCkpCisgICAg ICAgIGlmICghZGlkTm90aWZ5SW5zcGVjdG9yICYmICF2aW9sYXRlZERpcmVjdGl2ZS5kaXJlY3Rp dmVMaXN0KCkuaXNSZXBvcnRPbmx5KCkpIHsKICAgICAgICAgICAgIHJlcG9ydEJsb2NrZWRTY3Jp cHRFeGVjdXRpb25Ub0luc3BlY3Rvcih2aW9sYXRlZERpcmVjdGl2ZS50ZXh0KCkpOworICAgICAg ICAgICAgZGlkTm90aWZ5SW5zcGVjdG9yID0gdHJ1ZTsKKyAgICAgICAgfQogICAgIH07CiAgICAg cmV0dXJuIGFsbFBvbGljaWVzQWxsb3coV1RGTW92ZShoYW5kbGVWaW9sYXRlZERpcmVjdGl2ZSks ICZDb250ZW50U2VjdXJpdHlQb2xpY3lEaXJlY3RpdmVMaXN0Ojp2aW9sYXRlZERpcmVjdGl2ZUZv clVuc2FmZUV2YWwpOwogfQo=