Bug 154522 – CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Daniel Bates]

Update the SecurityPolicyViolationEvent attributes to more closely conform to the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>. Additionally, we should enable (by default) dispatching of a SecurityPolicyViolationEvent when a CSP violation occurs as support for this event is enabled by default in Google Chrome.

Currently the code for SecurityPolicyViolationEvent is not compiled because it is guarded by the ENABLE(CSP_NEXT) macro, which is disabled by default.

[Radar WebKit Bug Importer]

<rdar://problem/24762078>

[Daniel Bates]

The attribute statusCode in the definition of SecurityPolicyViolationEvent was changed from DOMString to unsigned short and this attribute was added to the definition of SecurityPolicyViolationEventInit in section Violation DOM Events of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).

[Daniel Bates]

Created attachment 272119 [details]
Patch and Layout Test

[Build Bot]

Comment on attachment 272119 [details]
Patch and Layout Test

Attachment 272119 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/878332

New failing tests:
js/dom/global-constructors-attributes.html

[Build Bot]

Created attachment 272128 [details]
Archive of layout-test-results from ews100 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 272119 [details]
Patch and Layout Test

Attachment 272119 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/878334

New failing tests:
js/dom/global-constructors-attributes.html

[Build Bot]

Created attachment 272129 [details]
Archive of layout-test-results from ews104 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews104  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 272119 [details]
Patch and Layout Test

Attachment 272119 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/878335

New failing tests:
js/dom/global-constructors-attributes.html

[Build Bot]

Created attachment 272131 [details]
Archive of layout-test-results from ews115 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews115  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Daniel Bates]

Created attachment 272155 [details]
Patch and Layout Tests

Update expected result for test js/dom/global-constructors-attributes.html

[Brent Fulgham]

Comment on attachment 272155 [details]
Patch and Layout Tests

View in context: https://bugs.webkit.org/attachment.cgi?id=272155&action=review

r=me.

> Source/WebCore/page/csp/ContentSecurityPolicy.cpp:364
> +        columnNumber = 0;

Consider 0-initializing when declared, and avoid this 'else' clause. I suppose there is a possible (small) performance hit but it's probably negligible.

[Daniel Bates]

(In reply to comment #11)
> [...]
> > Source/WebCore/page/csp/ContentSecurityPolicy.cpp:364
> > +        columnNumber = 0;
> 
> Consider 0-initializing when declared, and avoid this 'else' clause. I
> suppose there is a possible (small) performance hit but it's probably
> negligible.

Will initialize lineNumber and columnNumber to 0 at the site of their declaration (line 354 and line 355, respectively) before landing.

[Daniel Bates]

Committed r197118: <http://trac.webkit.org/changeset/197118>