Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 99a1610c70e2740d684e6d024775a2f3e2755e80
https://github.com/WebKit/WebKit/commit/99a1610c70e2740d684e6d024775a2f3e2755e80
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters.html
M Source/WebCore/page/csp/ContentSecurityPolicyTrustedTypesDirective.cpp
Log Message:
-----------
CSP: trusted-types expressions must reject trailing characters after keywords
and the wildcard
https://bugs.webkit.org/show_bug.cgi?id=318099
Reviewed by Darin Adler and Anne van Kesteren.
ContentSecurityPolicyTrustedTypesDirective::parse() classified each whitespace-
delimited tt-expression by matching only a *prefix* of the token: it used
skipExactly()/skipExactlyIgnoringASCIICase() for the wildcard and the
'allow-duplicates'/'none' keywords, and skipExactly<isPolicyNameCharacter>()
(which advances a single character) for tt-policy-name, then stored the whole
token without checking that nothing followed the matched prefix. As a result a
token with trailing characters was misclassified. Most visibly,
```
trusted-types *X
```
was treated as the wildcard "*" and set m_allowAny, so
trustedTypes.createPolicy()
was allowed for any name, even though "*X" is not a valid tt-expression. The
keyword forms ('allow-duplicates'X, 'none'X) and tt-policy-name validation (only
the first character was checked) had the same prefix-matching flaw.
Per the Trusted Types spec, each tt-expression must match a tt-keyword, the
tt-wildcard ("*"), or a tt-policy-name in its entirety; tt-wildcard is exactly
"*" and tt-policy-name is 1*( ALPHA / DIGIT / "-" / "#" / "=" / "_" / "/" / "@"
/ "." / "%" ). A token with any trailing character matches none of these and is
an invalid expression that must be ignored.
Classify each whole token instead of a prefix: compare the full token against
the keyword and wildcard literals, and accept a tt-policy-name only when every
character is a policy-name character. "*X" and similar malformed tokens are now
rejected, so trusted-types with no other valid expression blocks policy
creation.
This aligns WebKit with Blink and Gecko, both of which require the wildcard
token
to be exactly "*" and validate the entire policy-name token.
Test:
imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters.html
*
LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters.html:
Added.
* Source/WebCore/page/csp/ContentSecurityPolicyTrustedTypesDirective.cpp:
(WebCore::ContentSecurityPolicyTrustedTypesDirective::parse):
Canonical link: https://commits.webkit.org/316089@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
