Diff
Modified: trunk/LayoutTests/ChangeLog (286135 => 286136)
--- trunk/LayoutTests/ChangeLog 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/ChangeLog 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,3 +1,14 @@
+2021-11-23 Carlos Garcia Campos <[email protected]>
+
+ CSP: security policy violation event is always using document as target
+ https://bugs.webkit.org/show_bug.cgi?id=233182
+
+ Reviewed by Kate Cheney.
+
+ Unskip tests that no longer time out.
+
+ * TestExpectations:
+
2021-11-23 Alan Bujtas <[email protected]>
[IFC][Integration] Inflate ink overflow with box-shadow
Modified: trunk/LayoutTests/TestExpectations (286135 => 286136)
--- trunk/LayoutTests/TestExpectations 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/TestExpectations 2021-11-23 16:24:27 UTC (rev 286136)
@@ -525,8 +525,6 @@
imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-blocked-by-default.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme.html [ Skip ]
imported/w3c/web-platform-tests/cookies/domain/domain-attribute-host-with-and-without-leading-period.sub.https.html [ Skip ]
imported/w3c/web-platform-tests/cookies/domain/domain-attribute-host-with-leading-period.sub.https.html [ Skip ]
imported/w3c/web-platform-tests/cookies/domain/domain-attribute-matches-host.sub.https.html [ Skip ]
@@ -950,8 +948,6 @@
# Skip Content Security Policy tests that time out
imported/w3c/web-platform-tests/content-security-policy/navigate-to/href-location-cross-origin-allowed.sub.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/reporting/report-strips-fragment.html [ Skip ]
@@ -980,7 +976,6 @@
imported/w3c/web-platform-tests/content-security-policy/navigate-to/unsafe-allow-redirects/allowed-end-of-chain.sub.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/navigate-to/unsafe-allow-redirects/blocked-end-of-chain.sub.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-works-on-frame-src.https.sub.html [ Skip ]
-imported/w3c/web-platform-tests/content-security-policy/script-src/_javascript_-window-open-blocked.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample.html [ Skip ]
imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html [ Skip ]
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,3 +1,18 @@
+2021-11-23 Carlos Garcia Campos <[email protected]>
+
+ CSP: security policy violation event is always using document as target
+ https://bugs.webkit.org/show_bug.cgi?id=233182
+
+ Reviewed by Kate Cheney.
+
+ Update test expectations.
+
+ * web-platform-tests/content-security-policy/script-src/_javascript_-window-open-blocked-expected.txt:
+ * web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt:
+ * web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt:
+ * web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt:
+ * web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt:
+
2021-11-23 Antti Koivisto <[email protected]>
[:has() pseudo-class] Basic invalidation support
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/_javascript_-window-open-blocked-expected.txt (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/_javascript_-window-open-blocked-expected.txt 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/_javascript_-window-open-blocked-expected.txt 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,3 +1,3 @@
-
-FAIL Check that a securitypolicyviolation event is fired assert_equals: expected "inline" but got ""
+PASS Check that a securitypolicyviolation event is fired
+
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,5 +1,3 @@
-Harness Error (TIMEOUT), message = null
+FAIL Violations from data:-URL scripts have a sourceFile of 'blob' assert_equals: expected 16 but got 21
-TIMEOUT Violations from data:-URL scripts have a sourceFile of 'blob' Test timed out
-
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,5 +1,3 @@
-Harness Error (TIMEOUT), message = null
+FAIL Violations from data:-URL scripts have a sourceFile of 'data' assert_equals: expected 16 but got 21
-TIMEOUT Violations from data:-URL scripts have a sourceFile of 'data' Test timed out
-
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,9 +1,4 @@
-CONSOLE MESSAGE: The source list for Content Security Policy directive 'style-src' contains an invalid source: ''report-sample''. It will be ignored.
-CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
-Harness Error (TIMEOUT), message = null
+FAIL Inline style blocks should have a sample. assert_equals: expected "p { omg: yay !important; }" but got ""
+FAIL Inline style attributes should have a sample. assert_equals: expected "omg: yay !important;" but got ""
-TIMEOUT Inline style blocks should have a sample. Test timed out
-TIMEOUT Inline style attributes should have a sample. Test timed out
-
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt (286135 => 286136)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,8 +1,4 @@
-CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
-CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
-Harness Error (TIMEOUT), message = null
+PASS Inline style blocks should not have a sample.
+PASS Inline style attributes should not have a sample.
-TIMEOUT Inline style blocks should not have a sample. Test timed out
-TIMEOUT Inline style attributes should not have a sample. Test timed out
-
Modified: trunk/Source/WebCore/ChangeLog (286135 => 286136)
--- trunk/Source/WebCore/ChangeLog 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/ChangeLog 2021-11-23 16:24:27 UTC (rev 286136)
@@ -1,3 +1,34 @@
+2021-11-23 Carlos Garcia Campos <[email protected]>
+
+ CSP: security policy violation event is always using document as target
+ https://bugs.webkit.org/show_bug.cgi?id=233182
+
+ Reviewed by Kate Cheney.
+
+ We should use the violation element instead if not null.
+
+ * bindings/js/JSEventListener.cpp:
+ (WebCore::JSEventListener::handleEvent): Pass element to allowInlineEventHandlers().
+ * bindings/js/JSLazyEventListener.cpp:
+ (WebCore::JSLazyEventListener::initializeJSFunction const): Ditto.
+ * dom/Element.cpp:
+ (WebCore::Element::enqueueSecurityPolicyViolationEvent): Helper to queue securitypolicyviolationEvent for element.
+ * dom/Element.h:
+ * dom/InlineStyleSheetOwner.cpp:
+ (WebCore::InlineStyleSheetOwner::createSheet): Pass element to allowInlineStyle().
+ * dom/ScriptElement.cpp:
+ (WebCore::ScriptElement::requestModuleScript): Pass element to allowInlineScript().
+ (WebCore::ScriptElement::executeClassicScript): Ditto.
+ * dom/StyledElement.cpp:
+ (WebCore::StyledElement::styleAttributeChanged): Pass element to allowInlineStyle().
+ * page/csp/ContentSecurityPolicy.cpp:
+ (WebCore::ContentSecurityPolicy::allowInlineEventHandlers const): Pass given element to reportViolation().
+ (WebCore::ContentSecurityPolicy::allowInlineScript const): Ditto.
+ (WebCore::ContentSecurityPolicy::allowInlineStyle const): Ditto.
+ (WebCore::ContentSecurityPolicy::reportViolation const): Call Element::enqueueSecurityPolicyViolationEvent() if
+ element is not nullptr.
+ * page/csp/ContentSecurityPolicy.h:
+
2021-11-23 Antti Koivisto <[email protected]>
[:has() pseudo-class] Basic invalidation support
Modified: trunk/Source/WebCore/bindings/js/JSEventListener.cpp (286135 => 286136)
--- trunk/Source/WebCore/bindings/js/JSEventListener.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/bindings/js/JSEventListener.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -126,8 +126,11 @@
JSDOMWindow* window = jsCast<JSDOMWindow*>(globalObject);
if (!window->wrapped().isCurrentlyDisplayedInFrame())
return;
- if (wasCreatedFromMarkup() && !scriptExecutionContext.contentSecurityPolicy()->allowInlineEventHandlers(sourceURL().string(), sourcePosition().m_line, code()))
- return;
+ if (wasCreatedFromMarkup()) {
+ Element* element = event.target()->isNode() && !downcast<Node>(*event.target()).isDocumentNode() && is<Element>(*event.target()) ? downcast<Element>(event.target()) : nullptr;
+ if (!scriptExecutionContext.contentSecurityPolicy()->allowInlineEventHandlers(sourceURL().string(), sourcePosition().m_line, code(), element))
+ return;
+ }
// FIXME: Is this check needed for other contexts?
ScriptController& script = window->wrapped().frame()->script();
if (!script.canExecuteScripts(AboutToExecuteScript) || script.isPaused())
Modified: trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp (286135 => 286136)
--- trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -131,7 +131,8 @@
if (!document.frame())
return nullptr;
- if (!document.contentSecurityPolicy()->allowInlineEventHandlers(m_sourceURL.string(), m_sourcePosition.m_line, m_code))
+ Element* element = m_originalNode && !m_originalNode->isDocumentNode() && is<Element>(*m_originalNode) ? downcast<Element>(m_originalNode.get()) : nullptr;
+ if (!document.contentSecurityPolicy()->allowInlineEventHandlers(m_sourceURL.string(), m_sourcePosition.m_line, m_code, element))
return nullptr;
auto& script = document.frame()->script();
Modified: trunk/Source/WebCore/dom/Element.cpp (286135 => 286136)
--- trunk/Source/WebCore/dom/Element.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/dom/Element.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -53,6 +53,7 @@
#include "ElementRareData.h"
#include "EventDispatcher.h"
#include "EventHandler.h"
+#include "EventLoop.h"
#include "EventNames.h"
#include "FocusController.h"
#include "FocusEvent.h"
@@ -110,6 +111,7 @@
#include "ScriptDisallowedScope.h"
#include "ScrollIntoViewOptions.h"
#include "ScrollLatchingController.h"
+#include "SecurityPolicyViolationEvent.h"
#include "SelectorQuery.h"
#include "Settings.h"
#include "ShadowRootInit.h"
@@ -3198,6 +3200,13 @@
return false;
}
+void Element::enqueueSecurityPolicyViolationEvent(SecurityPolicyViolationEventInit&& eventInit)
+{
+ document().eventLoop().queueTask(TaskSource::DOMManipulation, [this, protectedThis = Ref { *this }, event = SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, WTFMove(eventInit), Event::IsTrusted::Yes)] {
+ dispatchEvent(event);
+ });
+}
+
ExceptionOr<void> Element::mergeWithNextTextNode(Text& node)
{
auto* next = node.nextSibling();
Modified: trunk/Source/WebCore/dom/Element.h (286135 => 286136)
--- trunk/Source/WebCore/dom/Element.h 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/dom/Element.h 2021-11-23 16:24:27 UTC (rev 286136)
@@ -88,6 +88,7 @@
struct ResizeObserverData;
struct ScrollIntoViewOptions;
struct ScrollToOptions;
+struct SecurityPolicyViolationEventInit;
struct ShadowRootInit;
namespace Style {
@@ -571,6 +572,8 @@
WEBCORE_EXPORT bool dispatchMouseForceWillBegin();
+ void enqueueSecurityPolicyViolationEvent(SecurityPolicyViolationEventInit&&);
+
virtual void willRecalcStyle(Style::Change);
virtual void didRecalcStyle(Style::Change);
virtual void willResetComputedStyle();
Modified: trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp (286135 => 286136)
--- trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -169,7 +169,7 @@
ASSERT(document.contentSecurityPolicy());
const ContentSecurityPolicy& contentSecurityPolicy = *document.contentSecurityPolicy();
bool hasKnownNonce = contentSecurityPolicy.allowStyleWithNonce(element.nonce(), element.isInUserAgentShadowTree());
- if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, hasKnownNonce))
+ if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, element, hasKnownNonce))
return;
auto mediaQueries = MediaQuerySet::create(m_media, MediaQueryParserContext(document));
Modified: trunk/Source/WebCore/dom/ScriptElement.cpp (286135 => 286136)
--- trunk/Source/WebCore/dom/ScriptElement.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/dom/ScriptElement.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -377,7 +377,7 @@
ASSERT(m_element.document().contentSecurityPolicy());
const auto& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(nonce, m_element.isInUserAgentShadowTree());
- if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), hasKnownNonce))
+ if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
return false;
m_loadableScript = WTFMove(script);
@@ -401,7 +401,7 @@
return;
bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(m_element.nonce(), m_element.isInUserAgentShadowTree());
- if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), hasKnownNonce))
+ if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
return;
}
Modified: trunk/Source/WebCore/dom/StyledElement.cpp (286135 => 286136)
--- trunk/Source/WebCore/dom/StyledElement.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/dom/StyledElement.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -206,7 +206,7 @@
if (document().scriptableDocumentParser() && !document().isInDocumentWrite())
startLineNumber = document().scriptableDocumentParser()->textPosition().m_line;
- if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, isInUserAgentShadowTree()))
+ if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, *this, isInUserAgentShadowTree()))
setInlineStyleFromString(newStyleString);
elementData()->setStyleAttributeIsDirty(false);
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp (286135 => 286136)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2021-11-23 16:24:27 UTC (rev 286136)
@@ -416,7 +416,7 @@
return checkHashAndReportViolation(source, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript, m_hashAlgorithmsForInlineScripts, handleViolatedDirective);
}
-bool ContentSecurityPolicy::allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& source, bool overrideContentSecurityPolicy) const
+bool ContentSecurityPolicy::allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& source, Element* element, bool overrideContentSecurityPolicy) const
{
if (overrideContentSecurityPolicy)
return true;
@@ -423,7 +423,7 @@
bool didNotifyInspector = false;
auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script for an inline event handler", "'unsafe-inline'");
- reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
+ reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, element);
if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
reportBlockedScriptExecutionToInspector(violatedDirective.text());
didNotifyInspector = true;
@@ -480,7 +480,7 @@
return allScriptPoliciesAllow(handleViolatedDirective, url, nonce, scriptContent, parserInserted);
}
-bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, bool overrideContentSecurityPolicy) const
+bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element& element, bool overrideContentSecurityPolicy) const
{
if (overrideContentSecurityPolicy || shouldPerformEarlyCSPCheck())
return true;
@@ -487,7 +487,7 @@
bool didNotifyInspector = false;
auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'");
- reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
+ reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
reportBlockedScriptExecutionToInspector(violatedDirective.text());
didNotifyInspector = true;
@@ -498,7 +498,7 @@
return checkHashAndReportViolation(scriptContent.toString(), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash, m_hashAlgorithmsForInlineScripts, handleViolatedDirective);
}
-bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, bool overrideContentSecurityPolicy) const
+bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, Element& element, bool overrideContentSecurityPolicy) const
{
if (overrideContentSecurityPolicy)
return true;
@@ -507,7 +507,7 @@
auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
auto name = shouldCheckUnsafeHashes == CheckUnsafeHashes::Yes ? ContentSecurityPolicyDirectiveNames::styleSrcAttr : ContentSecurityPolicyDirectiveNames::styleSrcElem;
String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::styleSrc, violatedDirective, URL(), "Refused to apply a stylesheet", "its hash, its nonce, or 'unsafe-inline'");
- reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
+ reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
};
if (shouldCheckUnsafeHashes == CheckUnsafeHashes::Yes)
@@ -734,12 +734,12 @@
return reportViolation(effectiveViolatedDirective, violatedDirective, violatedDirectiveList, blockedURL, consoleMessage, String(), TextPosition(OrdinalNumber::beforeFirst(), OrdinalNumber::beforeFirst()), state);
}
-void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state) const
+void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state, Element* element) const
{
- return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL);
+ return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL, element);
}
-void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL) const
+void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL, Element* element) const
{
logToConsole(consoleMessage, sourceURL, sourcePosition.m_line, sourcePosition.m_column, state);
@@ -804,8 +804,13 @@
violationEventInit.bubbles = true;
if (m_client)
m_client->enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
- else
- downcast<Document>(*m_scriptExecutionContext).enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
+ else {
+ auto& document = downcast<Document>(*m_scriptExecutionContext);
+ if (element && element->document() == document)
+ element->enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
+ else
+ document.enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
+ }
// 2. Send violation report (if applicable).
auto& reportURIs = violatedDirectiveList.reportURIs();
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h (286135 => 286136)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2021-11-23 15:47:54 UTC (rev 286135)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2021-11-23 16:24:27 UTC (rev 286136)
@@ -51,6 +51,7 @@
class ContentSecurityPolicyDirectiveList;
class ContentSecurityPolicySource;
class DOMStringList;
+class Element;
class Frame;
class JSWindowProxy;
class ResourceRequest;
@@ -95,10 +96,10 @@
bool allowStyleWithNonce(const String& nonce, bool overrideContentSecurityPolicy = false) const;
bool allowJavaScriptURLs(const String& contextURL, const OrdinalNumber& contextLine, const String& code, bool overrideContentSecurityPolicy = false) const;
- bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, bool overrideContentSecurityPolicy = false) const;
- bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, bool overrideContentSecurityPolicy = false) const;
+ bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, Element*, bool overrideContentSecurityPolicy = false) const;
+ bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element&, bool overrideContentSecurityPolicy = false) const;
bool allowNonParserInsertedScripts(const URL&, const String&, const StringView&, ParserInserted) const;
- bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, bool overrideContentSecurityPolicy = false) const;
+ bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, Element&, bool overrideContentSecurityPolicy = false) const;
bool allowEval(JSC::JSGlobalObject*, LogToConsole, bool overrideContentSecurityPolicy = false) const;
@@ -222,8 +223,8 @@
void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*) const;
void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList&, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* = nullptr) const;
- void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr) const;
- void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL()) const;
+ void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr, Element* = nullptr) const;
+ void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL(), Element* = nullptr) const;
void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
template<typename ViolatedDirective, typename HashSearchPolicy> bool checkHashAndReportViolation(const String&, const ViolatedDirective&, const HashSearchPolicy&, OptionSet<ContentSecurityPolicyHashAlgorithm>, ContentSecurityPolicy::ViolatedDirectiveCallback&&) const;
