269156 2024-02-10 21:19:18 -0800 Enforce conformant whitespace requirements for CSP policies 2024-02-12 00:43:20 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 255990 P2 Normal --- 1 mike mike annevk oldest_to_newest 2012552 0 mike 2024-02-10 21:19:18 -0800 Per https://w3c.github.io/webappsec-csp/#grammardef-optional-ascii-whitespace, the CSP spec throughout restricts allowed/required whitespace characters to the set of code points defined as “ASCII whitespace” in https://infra.spec.whatwg.org/#ascii-whitespace — which excludes the U+000B LINE TABULATION code point that some other specs additionally allow as whitespace. However, the current WebKit code currently allows the U+000B LINE TABULATION code point as whitespace in places where the CSP spec requirements disallow it. 2012553 1 mike 2024-02-10 21:20:26 -0800 I noticed this while working on the https://github.com/WebKit/WebKit/pull/24217 patch. 2012555 2 mike 2024-02-10 21:31:02 -0800 Pull request: https://github.com/WebKit/WebKit/pull/24222 2012655 3 mike 2024-02-12 00:43:20 -0800 *** This bug has been marked as a duplicate of bug 255990 ***