Bug 267916

Summary:	Avoid conversion to UTF-8 in ContentSecurityPolicy::allowInlineStyle when no algorithm is specified
Product:	WebKit	Reporter:	Ryosuke Niwa <rniwa>
Component:	DOM	Assignee:	Ryosuke Niwa <rniwa>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	Safari Technology Preview
Hardware:	Unspecified
OS:	Unspecified

Ryosuke Niwa

Reported 2024-01-23 00:50:09 PST

ContentSecurityPolicy::allowInlineStyle is currently converting every UTF-16 string into UTF-8 even when there is no CSP policy in place. i.e. even when both m_policies and m_hashAlgorithmsForInlineScripts are both empty.

Attachments
Add attachment proposed patch, testcase, etc.

Ryosuke Niwa

Comment 1 2024-01-23 00:52:43 PST

Pull request: https://github.com/WebKit/WebKit/pull/23099

EWS

Comment 2 2024-01-23 13:38:49 PST

Committed 273375@main (4bc7c5b5bdd3): <https://commits.webkit.org/273375@main> Reviewed commits have been landed. Closing PR #23099 and removing active labels.

Radar WebKit Bug Importer

Comment 3 2024-01-23 13:39:29 PST

<rdar://problem/121467313>

Note You need to log in before you can comment on or make changes to this bug.