Bug 234140 – Implement step 17 of main fetch algorithm

• Status: RESOLVED
• Resolution: FIXED
• Component: Service Workers

[youenn fablet]

Implement step 17 of main fetch algorithm

[youenn fablet]

Created attachment 446708 [details]
Patch

[EWS Watchlist]

This patch modifies the imported WPT tests. Please ensure that any changes on the tests (not coming from a WPT import) are exported to WPT. Please see https://trac.webkit.org/wiki/WPTExportProcess

[Brent Fulgham]

Comment on attachment 446708 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=446708&action=review

r=me

> LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers:1
> +Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}; connect-src 'unsafe-inline' 'self'

Do you know if this new connect-src rule is needed because of a bug in our CSP implementation?

[youenn fablet]

(In reply to Brent Fulgham from comment #3)
> Comment on attachment 446708 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=446708&action=review
> 
> r=me
> 
> > LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers:1
> > +Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}; connect-src 'unsafe-inline' 'self'
> 
> Do you know if this new connect-src rule is needed because of a bug in our
> CSP implementation?

It is needed because the rule was only about image and we are now adding a restriction to fetch loads as well.

[youenn fablet]

<rdar://problem/85388372>

[EWS]

Committed r286940 (245165@main): <https://commits.webkit.org/245165@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 446708 [details].