Bug 165531 - [CSP] Policy of window opener not applied to about:blank window
Summary: [CSP] Policy of window opener not applied to about:blank window
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Local Build
Hardware: All All
: P2 Normal
Assignee: Daniel Bates
URL:
Keywords: InRadar
Depends on:
Blocks: 172038
  Show dependency tree / graph
 
Reported: 2016-12-07 10:24 PST by Daniel Bates
Modified: 2017-05-12 15:08 PDT (History)
10 users (show)

See Also:

Attachments
Patch and layout test (11.80 KB, patch)
2016-12-07 10:35 PST, Daniel Bates 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2016-12-07 10:24:52 PST 
about:blank windows should inherit the content security policy of their opener document.
Comment 1 Daniel Bates 2016-12-07 10:25:29 PST 
<rdar://problem/29426639>
Comment 2 Daniel Bates 2016-12-07 10:35:33 PST 
Created attachment 296398 [details]
Patch and layout test

I chose to remove the upgrade-insecure-requests comment from Document::initContentSecurityPolicy() because I did not see the value in it and its second to last sentence was inaccurate with respect to this function. Let me know if there is value in adding a comment to Document::initContentSecurityPolicy() about how we handle upgrade insecure requests. We should look to centralize the upgrade-insecure-requests inheritance logic for child frames and child windows. Currently this logic is dispersed across Document::initSecurityContext(), Document::initContentSecurityPolicy(), and DocumentWriter::begin(). I suggest we do this in a separate bug.
Comment 3 Brent Fulgham 2016-12-09 09:24:02 PST 
Comment on attachment 296398 [details]
Patch and layout test

Looks good. r=me.
Comment 4 Daniel Bates 2016-12-09 09:27:56 PST 
Comment on attachment 296398 [details]
Patch and layout test

Clearing flags on attachment: 296398

Committed r209608: <http://trac.webkit.org/changeset/209608>
Comment 5 Daniel Bates 2016-12-09 09:28:01 PST 
All reviewed patches have been landed.  Closing bug.