Bug 289904
| Summary: | require-trusted-types-for CSP parsing allows invalid sink groups | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Luke Warlow <lwarlow> |
| Component: | New Bugs | Assignee: | Luke Warlow <lwarlow> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Other | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=267579 | ||
Luke Warlow
Currently, 'script''script' parses as if it was 'script'. This should be changed to be treated as invalid.
The parsing also early returns if it finds an invalid sink group. This is incorrect behaviour. It should report this invalid sink group but keep parsing in case it finds a valid one.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/147760089>
Luke Warlow
Pull request: https://github.com/WebKit/WebKit/pull/43118
EWS
Committed 300770@main (18919c9e6b22): <https://commits.webkit.org/300770@main>
Reviewed commits have been landed. Closing PR #43118 and removing active labels.