Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 34ec6930288c2a21d0c70b2bbcb5006438d26cc0
https://github.com/WebKit/WebKit/commit/34ec6930288c2a21d0c70b2bbcb5006438d26cc0
Author: Roberto Rodriguez <[email protected]>
Date: 2026-06-24 (Wed, 24 Jun 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-cross-origin-same-document-navigation.window-expected.txt
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/PolicyChecker.cpp
M Source/WebCore/loader/PolicyChecker.h
Log Message:
-----------
Same-page navigations should not be checked against CSP
https://bugs.webkit.org/show_bug.cgi?id=317614
rdar://180342503
Reviewed by Anne van Kesteren.
When content that's already loaded navigates to a #fragment of the same page,
no new fetch
takes place, so CSP should not be checked against it. WebKit currently does,
reporting a
violation and cancelling the navigation.
Fix by skipping the CSP check for same-document navigations, so changing only a
URL's fragment
is no longer treated as a new load. Cross-document loads remain checked as
before.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-cross-origin-same-document-navigation.window-expected.txt:
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadURL):
(WebCore::FrameLoader::loadWithDocumentLoader):
* Source/WebCore/loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):
* Source/WebCore/loader/PolicyChecker.h:
Canonical link: https://commits.webkit.org/315759@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
