Bug 185367 – CSP should be passed the referrer

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Daniel Bates]

A ContentSecurityPolicy object currently depends on either a ScriptExecutionContext or a Frame in order to perform logging, dispatch DOM events, and send CSP reports. Ideally, we want it be dependent on a delegate to perform these operations so that we can implement them appropriate for workers and with respect to the NetworkProcess. Notice that class Document extends ScriptExecutionContext. For documents, one of the reasons the class ContentSecurityPolicy has a dependency on ScriptExecutionContext is because it needs to know the document's referrer when dispatching DOM events and sending CSP reports for violations. It is sufficient to pass the referrer information to a ContentSecurityPolicy directly instead of having ContentSecurityPolicy indirectly query this information from the specified ScriptExecutionContext or Frame. This will also make it straightforward to correctly compute the referrer for a worker in a subsequent bug.

[Daniel Bates]

Created attachment 339695 [details]
Patch

[Daniel Bates]

(In reply to Daniel Bates from comment #0)
> Ideally, we want it be dependent on a delegate
> to perform these operations so that we can implement them appropriate for
> workers and with respect to the NetworkProcess. Notice that class Document
> extends ScriptExecutionContext.


This should read:

Ideally, we want it to be dependent only on a delegate to perform these operations so that we can implement them appropriately for workers and with respect to the NetworkProcess. 


> This will also make it straightforward to correctly compute the referrer for a worker in a subsequent bug.

Disregard this remark. Only documents have a referrer. That is, workers do not have a referrer.

[Per Arne Vollan]

Comment on attachment 339695 [details]
Patch

R=me. Do we already have test coverage for this?

[Daniel Bates]

(In reply to Per Arne Vollan from comment #3)
> Do we already have test coverage for this?

Yes, we do.

[Daniel Bates]

Comment on attachment 339695 [details]
Patch

Clearing flags on attachment: 339695

Committed r231445: <https://trac.webkit.org/changeset/231445>

[Daniel Bates]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/40028310>