220724 – CSP: Consider dropping support for 'plugin-types'

Bug 220724 - CSP: Consider dropping support for 'plugin-types'

Summary: CSP: Consider dropping support for 'plugin-types'

Status:	NEW

Alias:	None

Product:	WebKit
Classification:	Unclassified
Component:	New Bugs (show other bugs)
Version:	WebKit Nightly Build
Hardware:	Unspecified Unspecified

Importance:	P2 Normal
Assignee:	Nobody

URL:
Keywords:	InRadar

Depends on:
Blocks:

Reported:	2021-01-19 00:57 PST by Antonio Sartori
Modified:	2021-02-19 04:36 PST (History)
CC List:	3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Antonio Sartori 2021-01-19 00:57:17 PST

There is a discussion on the Content Security Policy spec about removing the 'plugin-types' directive, which is not that helpful anymore since Flash support has been discontinued, see https://github.com/w3c/webappsec-csp/issues/394.

Would WebKit be also interested in dropping that?

Comment 1 Radar WebKit Bug Importer 2021-01-21 18:15:13 PST

<rdar://problem/73478460>

Comment 2 Antonio Sartori 2021-02-19 04:36:46 PST

Notice that even if it looks like WebKit does not support plugin-types (https://wpt.fyi/results/content-security-policy/plugin-types?label=master&label=experimental&aligned, https://wpt.fyi/results/content-security-policy/plugin-types?sha=f207cfdd15&label=master&max-count=1), there seems to be some plugin-types related check in the code https://github.com/WebKit/WebKit/blob/main/Source/WebCore/html/HTMLPlugInImageElement.cpp#L304