Bug 316356

Summary:	<object> elements loading images are incorrectly blocked by img-src CSP directive
Product:	WebKit	Reporter:	roberto_rodriguez2
Component:	New Bugs	Assignee:	roberto_rodriguez2
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

roberto_rodriguez2

Reported 2026-06-04 17:29:11 PDT

When an <object> element loads image content, the resource is checked against both object-src and img-src. A page with object-src *; img-src 'none' incorrectly blocks images in object tags. Per the spec, object-src is the only directive that should apply.

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-06-04 17:29:18 PDT

<rdar://problem/178772677>

roberto_rodriguez2

Comment 2 2026-06-04 22:47:30 PDT

Pull request: https://github.com/WebKit/WebKit/pull/66524

EWS

Comment 3 2026-06-05 16:19:53 PDT

Committed 314668@main (1a1efe9cf4e6): <https://commits.webkit.org/314668@main> Reviewed commits have been landed. Closing PR #66524 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.