Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dc55580d736adcfaf04bb4cd944937481258936d
https://github.com/WebKit/WebKit/commit/dc55580d736adcfaf04bb4cd944937481258936d
Author: Roberto Rodriguez <[email protected]>
Date: 2026-06-24 (Wed, 24 Jun 2026)
Changed paths:
R
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored-expected.txt
R
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored.html
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/report-only-frame.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub-expected.txt
M Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp
Log Message:
-----------
CSP report-only frame-ancestors is ignored instead of being reported
https://bugs.webkit.org/show_bug.cgi?id=317686
rdar://180447621
Reviewed by Anne van Kesteren.
A frame-ancestors directive in a report-only policy should report violations
without blocking the frame.
Currently, no reports are sent because when parsing a report-only policy,
WebKit discards the frame-ancestors
directive. As a result, the violation is never detected or reported. This
followed CSP Level 2 spec 7.7
(https://www.w3.org/TR/CSP2/#directive-frame-ancestors) which required
report-only frame-ancestors to be ignored.
This is no longer present in CSP Level 3 spec 6.4.2
(https://www.w3.org/TR/CSP3/#directive-frame-ancestors).
Fix by storing the frame-ancestors directive when parsing a report-only policy
instead of discarding it. Once
it is stored, the existing checks in ContentSecurityPolicy::allPoliciesAllow
find the violation and report it,
but not enforce it, allowing the frame to load.
*
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored-expected.txt:
Removed.
*
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored.html:
Removed.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/report-only-frame.sub-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub-expected.txt:
* Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp:
(WebCore::ContentSecurityPolicyDirectiveList::addDirective):
Canonical link: https://commits.webkit.org/315753@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
