Summary: | CSP 1.1: Add 'plugin-types' and 'form-action' DOM API. | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mike West <mkwst> | ||||
Component: | WebCore Misc. | Assignee: | Mike West <mkwst> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | abarth, ojan, webkit.review.bot | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 85558 | ||||||
Attachments: |
|
Description
Mike West
2012-08-18 12:22:07 PDT
Created attachment 159266 [details]
Patch
Hey Adam, would you mind taking a look at this? I didn't add 'script-nonce' in this patch, as I'm not entirely sure that's a good idea. I'm tempted to address it with something like 'requiresNonce' that would return a bool, rather than giving script the ability to brute-force the nonce by continually checking 'allowsNonce("xxx")'. I'll drop an email to the list to see if anyone has a strong opinion on the matter. Thanks! > I didn't add 'script-nonce' in this patch, as I'm not entirely sure that's a good idea. I'm tempted to address it with something like 'requiresNonce' that would return a bool, rather than giving script the ability to brute-force the nonce by continually checking 'allowsNonce("xxx")'.
Another possibility is to have the nonce available in JavaScript under the theory that if you can read that property, you're already able to execute script... Hum... Let's wait a bit while we experiment with script-nonce to see how we end up using it.
Comment on attachment 159266 [details]
Patch
Waiting sounds reasonable.
Speaking of waiting... CQ? (maybe this week...)
Comment on attachment 159266 [details] Patch Clearing flags on attachment: 159266 Committed r125983: <http://trac.webkit.org/changeset/125983> All reviewed patches have been landed. Closing bug. |