Diff
Modified: trunk/LayoutTests/ChangeLog (259828 => 259829)
--- trunk/LayoutTests/ChangeLog 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/ChangeLog 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,3 +1,47 @@
+2020-04-09 Keith Miller <[email protected]>
+
+ Remove legacy X-WebKit-CSP header support
+ https://bugs.webkit.org/show_bug.cgi?id=210256
+
+ Reviewed by Geoffrey Garen.
+
+ Fix tests so they ensure we don't respect legacy CSP headers anymore.
+
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt:
+ * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
+
2020-04-09 Devin Rousso <[email protected]>
Web Inspector: Debugger: debug hooks should also be emitted for the first sub-_expression_ in a comma _expression_
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,7 +1,10 @@
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl because it does not appear in the form-action directive of the Content Security Policy.
-
-Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+This page was requested with the HTTP method POST.
+Parameters:
+
+fieldname = fieldvalue
+
============== Back Forward List ==============
-curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html **nav target**
+ http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html **nav target**
+curr-> http://127.0.0.1:8000/navigation/resources/form-target.pl **nav target**
===============================================
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -25,6 +25,10 @@
<input type='submit' id='submit' value='submit'>
</form>
- <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
+ <p>
+ Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+
+ Update: Since we no longer support X-WebKit-CSP all the form should be submitted.
+ </p>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,7 +1,9 @@
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue because it does not appear in the form-action directive of the Content Security Policy.
-
-Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+This page was requested with the HTTP method GET.
+Parameters:
+
+fieldname = fieldvalue
+
============== Back Forward List ==============
-curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html **nav target**
+curr-> http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue **nav target**
===============================================
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -23,6 +23,10 @@
<input type='submit' id='submit' value='submit'>
</form>
- <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
+ <p>
+ Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+
+ Update: Since we no longer support X-WebKit-CSP the form should be submitted.
+ </p>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,6 +1,6 @@
-CONSOLE MESSAGE: Refused to load _javascript_:alert("FAIL!") because it does not appear in the form-action directive of the Content Security Policy.
+ALERT: RAN CODE CORRECTLY!
-Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a _javascript_ alert.
+Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a _javascript_ alert. Update: Since we no longer support X-WebKit-CSP the form should be submitted.
============== Back Forward List ==============
curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked.html **nav target**
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-_javascript_-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -20,11 +20,15 @@
</script>
</head>
<body>
- <form action='' id='theform' method='post'>
+ <form action='' id='theform' method='post'>
<input type='text' name='fieldname' value='fieldvalue'>
<input type='submit' id='submit' value='submit'>
</form>
- <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a _javascript_ alert.</p>
+ <p>
+ Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a _javascript_ alert.
+
+ Update: Since we no longer support X-WebKit-CSP the form should be submitted.
+ </p>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,7 +1,5 @@
-CONSOLE MESSAGE: Refused to load http://localhost:8000/navigation/resources/form-target.pl because it does not appear in the form-action directive of the Content Security Policy.
-
-Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+This page was requested with the HTTP method GET.
-============== Back Forward List ==============
-curr-> http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html **nav target**
-===============================================
+Parameters:
+
+
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -25,6 +25,10 @@
<input type='submit' id='submit' value='submit'>
</form>
- <p>Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
+ <p>
+ Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
+
+ Update: Since we no longer support X-WebKit-CSP the form should be submitted.
+ </p>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,6 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-Only the first two of these scripts should execute even though there are parse errors in the policy.
+Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -7,8 +7,8 @@
['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],
['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
- ['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
- ['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
+ ['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
+ ['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
];
</script>
</head>
@@ -15,4 +15,6 @@
<body _onload_="testExperimentalPolicy()">
<p>
Only the first two of these scripts should execute even though there are parse errors in the policy.
+
+ Update: Since we no longer support X-WebKit-CSP all the scripts should run.
</p>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,26 +1,4 @@
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''n'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-None of these scripts should execute, as all the nonces are invalid.
+None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -4,16 +4,16 @@
<script src=''></script>
<script>
var tests = [
- ['no', 'script-src \'n', 'resources/script.js', ''],
- ['no', 'script-src \'nonce', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-\'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-', 'resources/script.js', ''],
- ['no', 'script-src nonce-abcd', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
- ['no', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
+ ['yes', 'script-src \'n', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
+ ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
+ ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
];
</script>
</head>
@@ -20,4 +20,6 @@
<body _onload_="testExperimentalPolicy()">
<p>
None of these scripts should execute, as all the nonces are invalid.
+
+ Update: Since we no longer support X-WebKit-CSP all the scripts should run.
</p>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,18 +1,3 @@
CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-PASS did not execute script.
-
-
-
---------
-Frame: '<!--frame1-->'
---------
-CSP report received:
-CONTENT_TYPE: application/csp-report
-HTTP_HOST: 127.0.0.1:8000
-HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
-REQUEST_METHOD: POST
-REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
-=== POST DATA =""
-{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}
+CONSOLE MESSAGE: line 11: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -6,17 +6,17 @@
<html>
<head>
<script nonce="dump-as-text">
-if (window.testRunner) {
+if (window.testRunner)
testRunner.dumpAsText();
- testRunner.dumpChildFramesAsText();
-}
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script>
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
+<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src=""
+once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,3 +1,3 @@
CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
+CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -11,9 +11,9 @@
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script>
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,6 +1,5 @@
CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -13,9 +13,9 @@
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script>
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
<iframe src=""
</body>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,6 +1,5 @@
CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -13,9 +13,9 @@
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script>
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
<iframe src=""
</body>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,19 +1,2 @@
CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-PASS did not execute script.
-
-
-
---------
-Frame: '<!--frame1-->'
---------
-CSP report received:
-CONTENT_TYPE: application/csp-report
-HTTP_HOST: 127.0.0.1:8000
-HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
-REQUEST_METHOD: POST
-REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
-=== POST DATA =""
-{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -6,17 +6,17 @@
<html>
<head>
<script nonce="dump-as-text">
-if (window.testRunner) {
+if (window.testRunner)
testRunner.dumpAsText();
- testRunner.dumpChildFramesAsText();
-}
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
+<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src=""
+once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,4 +1,2 @@
CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
-CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -11,9 +11,9 @@
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,17 +1 @@
-CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
-
-
-
---------
-Frame: '<!--frame1-->'
---------
-CSP report received:
-CONTENT_TYPE: application/csp-report
-HTTP_HOST: 127.0.0.1:8000
-HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
-REQUEST_METHOD: POST
-REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
-=== POST DATA =""
-{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -6,17 +6,17 @@
<html>
<head>
<script nonce="dump-as-text">
-if (window.testRunner) {
+if (window.testRunner)
testRunner.dumpAsText();
- testRunner.dumpChildFramesAsText();
-}
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
+<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src=""
+once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,17 +1 @@
-CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
-PASS did not execute script.
-
-
-
---------
-Frame: '<!--frame1-->'
---------
-CSP report received:
-CONTENT_TYPE: application/csp-report
-HTTP_HOST: 127.0.0.1:8000
-HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php
-REQUEST_METHOD: POST
-REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
-=== POST DATA =""
-{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}
+PASS did execute script.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php 2020-04-09 21:31:03 UTC (rev 259829)
@@ -6,17 +6,17 @@
<head>
<meta http-equiv="X-WebKit-CSP" content="script-src 'nonce-dump-as-text'">
<script nonce="dump-as-text">
-if (window.testRunner) {
+if (window.testRunner)
testRunner.dumpAsText();
- testRunner.dumpChildFramesAsText();
-}
</script>
</head>
<body>
-<p id="result">PASS did not execute script.</p>
+<p id="result">FAIL did not execute script.</p>
<script nonce="dummy">
-document.getElementById("result").textContent = "FAIL did execute script.";
+document.getElementById("result").textContent = "PASS did execute script.";
</script>
+<!-- Call testRunner.dumpChildFramesAsText() and load
<iframe src=""
+once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,6 +1,4 @@
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-Only the first two of these scripts should execute even though there are parse errors in the policy.
+Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -7,8 +7,8 @@
['yes', 'script-src 127.0.0.1:8000', 'resources/script.js', 'nonce'],
['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
- ['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
- ['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
+ ['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
+ ['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
];
</script>
</head>
@@ -15,4 +15,6 @@
<body _onload_="testExperimentalPolicy()">
<p>
Only the first two of these scripts should execute even though there are parse errors in the policy.
+
+ Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
</p>
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,26 +1,4 @@
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''n'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
-CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
-None of these scripts should execute, as all the nonces are invalid.
+None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html (259828 => 259829)
--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html 2020-04-09 21:31:03 UTC (rev 259829)
@@ -4,16 +4,16 @@
<script src=''></script>
<script>
var tests = [
- ['no', 'script-src \'n', 'resources/script.js', ''],
- ['no', 'script-src \'nonce', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-\'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-', 'resources/script.js', ''],
- ['no', 'script-src nonce-abcd', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
- ['no', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
- ['no', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
+ ['yes', 'script-src \'n', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
+ ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
+ ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
+ ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
];
</script>
</head>
@@ -20,4 +20,6 @@
<body _onload_="testExperimentalPolicy()">
<p>
None of these scripts should execute, as all the nonces are invalid.
+
+ Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
</p>
Modified: trunk/Source/WebCore/ChangeLog (259828 => 259829)
--- trunk/Source/WebCore/ChangeLog 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/ChangeLog 2020-04-09 21:31:03 UTC (rev 259829)
@@ -1,3 +1,27 @@
+2020-04-09 Keith Miller <[email protected]>
+
+ Remove legacy X-WebKit-CSP header support
+ https://bugs.webkit.org/show_bug.cgi?id=210256
+ <rdar://problem/60634363>
+
+ Reviewed by Geoffrey Garen.
+
+ Supporting this header is causes compatibly issues for some sites
+ and they appear to be misconfigured. Additionally, no other
+ browser has supported these headers in many years. This patch
+ removes all support for the legacy X-WebKit-CSP header.
+
+ * dom/Document.cpp:
+ (WebCore::Document::processHttpEquiv):
+ * page/csp/ContentSecurityPolicyDirectiveList.cpp:
+ (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList):
+ * page/csp/ContentSecurityPolicyResponseHeaders.cpp:
+ (WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):
+ * page/csp/ContentSecurityPolicyResponseHeaders.h:
+ * platform/network/HTTPHeaderNames.in:
+ * platform/network/ResourceResponseBase.cpp:
+ (WebCore::isSafeCrossOriginResponseHeader):
+
2020-04-09 Per Arne Vollan <[email protected]>
[Cocoa] The function WebCore::systemHasBattery() should cache the result.
Modified: trunk/Source/WebCore/dom/Document.cpp (259828 => 259829)
--- trunk/Source/WebCore/dom/Document.cpp 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/dom/Document.cpp 2020-04-09 21:31:03 UTC (rev 259829)
@@ -3645,11 +3645,6 @@
contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::Enforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
break;
- case HTTPHeaderName::XWebKitCSP:
- if (isInDocumentHead)
- contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::PrefixedEnforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
- break;
-
default:
break;
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp (259828 => 259829)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp 2020-04-09 21:31:03 UTC (rev 259829)
@@ -117,8 +117,8 @@
ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList(ContentSecurityPolicy& policy, ContentSecurityPolicyHeaderType type)
: m_policy(policy)
, m_headerType(type)
+ , m_reportOnly(type == ContentSecurityPolicyHeaderType::Report)
{
- m_reportOnly = (type == ContentSecurityPolicyHeaderType::Report || type == ContentSecurityPolicyHeaderType::PrefixedReport);
}
std::unique_ptr<ContentSecurityPolicyDirectiveList> ContentSecurityPolicyDirectiveList::create(ContentSecurityPolicy& policy, const String& header, ContentSecurityPolicyHeaderType type, ContentSecurityPolicy::PolicyFrom from)
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp (259828 => 259829)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp 2020-04-09 21:31:03 UTC (rev 259829)
@@ -41,14 +41,6 @@
if (!policyValue.isEmpty())
m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::Report });
- policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSP);
- if (!policyValue.isEmpty())
- m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedEnforce });
-
- policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSPReportOnly);
- if (!policyValue.isEmpty())
- m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedReport });
-
m_httpStatusCode = response.httpStatusCode();
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h (259828 => 259829)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h 2020-04-09 21:31:03 UTC (rev 259829)
@@ -36,8 +36,6 @@
enum class ContentSecurityPolicyHeaderType {
Report,
Enforce,
- PrefixedReport,
- PrefixedEnforce,
};
class ContentSecurityPolicyResponseHeaders {
Modified: trunk/Source/WebCore/platform/network/HTTPHeaderNames.in (259828 => 259829)
--- trunk/Source/WebCore/platform/network/HTTPHeaderNames.in 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/platform/network/HTTPHeaderNames.in 2020-04-09 21:31:03 UTC (rev 259829)
@@ -102,8 +102,6 @@
X-DNS-Prefetch-Control
X-Frame-Options
X-SourceMap
-X-WebKit-CSP
-X-WebKit-CSP-Report-Only
X-XSS-Protection
X-Temp-Tablet
Modified: trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp (259828 => 259829)
--- trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2020-04-09 21:20:43 UTC (rev 259828)
+++ trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp 2020-04-09 21:31:03 UTC (rev 259829)
@@ -435,8 +435,6 @@
|| name == HTTPHeaderName::XContentTypeOptions
|| name == HTTPHeaderName::XDNSPrefetchControl
|| name == HTTPHeaderName::XFrameOptions
- || name == HTTPHeaderName::XWebKitCSP
- || name == HTTPHeaderName::XWebKitCSPReportOnly
|| name == HTTPHeaderName::XXSSProtection;
}
