Bug 220724 – CSP: Consider dropping support for 'plugin-types'

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Antonio Sartori]

There is a discussion on the Content Security Policy spec about removing the 'plugin-types' directive, which is not that helpful anymore since Flash support has been discontinued, see https://github.com/w3c/webappsec-csp/issues/394.

Would WebKit be also interested in dropping that?

[Radar WebKit Bug Importer]

<rdar://problem/73478460>

[Antonio Sartori]

Notice that even if it looks like WebKit does not support plugin-types (https://wpt.fyi/results/content-security-policy/plugin-types?label=master&label=experimental&aligned, https://wpt.fyi/results/content-security-policy/plugin-types?sha=f207cfdd15&label=master&max-count=1), there seems to be some plugin-types related check in the code https://github.com/WebKit/WebKit/blob/main/Source/WebCore/html/HTMLPlugInImageElement.cpp#L304

[Brent Fulgham]

Indeed, this was completely removed. See https://github.com/w3c/webappsec-csp/pull/456.

This is now creating compatibility issues so we should clean this up.

[Brent Fulgham]

This is now tracked by:
<rdar://problem/144415855>

[Brent Fulgham]

Pull request: https://github.com/WebKit/WebKit/pull/62211

[EWS]

Committed 310938@main (488d5d7e89af): <https://commits.webkit.org/310938@main>

Reviewed commits have been landed. Closing PR #62211 and removing active labels.