Bug 225862 - CSP does not apply to AudioWorklets
Summary: CSP does not apply to AudioWorklets
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-05-17 03:14 PDT by Sam Sneddon [:gsnedders]
Modified: 2021-05-26 13:36 PDT (History)
16 users (show)

See Also:


Attachments
WIP Patch (5.53 KB, patch)
2021-05-25 12:52 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
WIP Patch (791 bytes, patch)
2021-05-25 14:56 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (7.34 KB, patch)
2021-05-25 15:34 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (10.84 KB, patch)
2021-05-25 15:42 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Radar WebKit Bug Importer 2021-05-17 03:15:36 PDT
<rdar://problem/78098440>
Comment 2 Chris Dumez 2021-05-25 12:52:18 PDT
Created attachment 429681 [details]
WIP Patch
Comment 3 Chris Dumez 2021-05-25 12:57:51 PDT
(In reply to Sam Sneddon [:gsnedders] from comment #0)
> c.f.:
> 
> https://wpt.fyi/results/content-security-policy/gen/top.http-rp/script-src-
> self/worklet-audio.https.html
> https://wpt.fyi/results/content-security-policy/gen/top.http-rp/script-src-
> self/worklet-audio-import-data.https.html
> https://wpt.fyi/results/content-security-policy/gen/top.http-rp/script-src-
> wildcard/worklet-audio-import-data.https.html
> 
> These all seem to be doing much worse than the related Worker tests.

Sadly the tests in questions are not part of our test suite yet.
Comment 4 Chris Dumez 2021-05-25 14:56:37 PDT
Created attachment 429696 [details]
WIP Patch
Comment 5 Chris Dumez 2021-05-25 15:34:52 PDT
Created attachment 429700 [details]
Patch
Comment 6 Chris Dumez 2021-05-25 15:42:56 PDT
Created attachment 429703 [details]
Patch
Comment 7 EWS 2021-05-25 17:29:10 PDT
Committed r278068 (238147@main): <https://commits.webkit.org/238147@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 429703 [details].
Comment 8 Truitt Savell 2021-05-26 13:31:43 PDT
Looks like the new tests added in https://trac.webkit.org/changeset/278068/webkit

http/tests/security/contentSecurityPolicy/audioworklet-script-src-blocked.html
http/tests/security/contentSecurityPolicy/audioworklet-script-src-allowed.html 

are constant timeouts on windows.
history:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-script-src-allowed.html&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-script-src-blocked.html
Comment 9 Chris Dumez 2021-05-26 13:32:24 PDT
(In reply to Truitt Savell from comment #8)
> Looks like the new tests added in
> https://trac.webkit.org/changeset/278068/webkit
> 
> http/tests/security/contentSecurityPolicy/audioworklet-script-src-blocked.
> html
> http/tests/security/contentSecurityPolicy/audioworklet-script-src-allowed.
> html 
> 
> are constant timeouts on windows.
> history:
> https://results.webkit.org/?suite=layout-tests&suite=layout-
> tests&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-
> script-src-allowed.
> html&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-
> script-src-blocked.html

OH, Windows doesn't have WebAudio. We need to skip the tests there with the other WebAudio tests.
Comment 10 Chris Dumez 2021-05-26 13:36:42 PDT
(In reply to Chris Dumez from comment #9)
> (In reply to Truitt Savell from comment #8)
> > Looks like the new tests added in
> > https://trac.webkit.org/changeset/278068/webkit
> > 
> > http/tests/security/contentSecurityPolicy/audioworklet-script-src-blocked.
> > html
> > http/tests/security/contentSecurityPolicy/audioworklet-script-src-allowed.
> > html 
> > 
> > are constant timeouts on windows.
> > history:
> > https://results.webkit.org/?suite=layout-tests&suite=layout-
> > tests&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-
> > script-src-allowed.
> > html&test=http%2Ftests%2Fsecurity%2FcontentSecurityPolicy%2Faudioworklet-
> > script-src-blocked.html
> 
> OH, Windows doesn't have WebAudio. We need to skip the tests there with the
> other WebAudio tests.

 <https://commits.webkit.org/r278122>