Bug 154288 – CSP: Violation report should include HTTP status code and effective-directive of protected resource

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Daniel Bates]

The Content Security Policy violation report should include the HTTP status code of the protected resource as per <https://w3c.github.io/webappsec-csp/2/#violation-reports> (29 August 2015):

[[
4.4. Reporting

...

To generate a violation report object, the user agent MUST use an algorithm equivalent to the following:

Prepare a JSON object violation with the following keys and values:

    blocked-uri
        The originally requested URL of the resource that was prevented from loading, stripped for reporting, or 
        the empty string if the resource has no URL (inline script and inline style, for example).
...
    status-code
        The status-code of the HTTP response that contained the protected resource, if the protected resource was
        obtained over HTTP. Otherwise, the number 0.
...
]]

[Radar WebKit Bug Importer]

<rdar://problem/24674982>

[Daniel Bates]

We should also include the effective-directive key in the violation report.

[Daniel Bates]

Created attachment 271679 [details]
Patch and Layout Tests

This patch will fail to apply because it depends on changes to file LayoutTests/TestExpectations made in the patch for bug #154307.

[Brent Fulgham]

Comment on attachment 271679 [details]
Patch and Layout Tests

r=me.

[Brent Fulgham]

*** Bug 115707 has been marked as a duplicate of this bug. ***

[Daniel Bates]

Committed r196876: <http://trac.webkit.org/changeset/196876>