Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 35cfc0baa7e78315ea8453fd3239765ab652968f
https://github.com/WebKit/WebKit/commit/35cfc0baa7e78315ea8453fd3239765ab652968f
Author: Charlie Wolfe <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/incremental-pdf.py
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/linearized.pdf
M Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
M Source/WebCore/loader/NetscapePlugInStreamLoader.h
M Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
M Source/WebKit/WebProcess/Network/WebLoaderStrategy.h
M Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm
M Source/WebKit/WebProcess/Plugins/PluginView.cpp
M Source/WebKit/WebProcess/Plugins/PluginView.h
M Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.cpp
M Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h
Log Message:
-----------
Plug-in byte-range requests are blocked by connect-src instead of being
governed by object-src
https://bugs.webkit.org/show_bug.cgi?id=321145
rdar://184258237
Reviewed by Ryan Reno.
NetscapePlugInStreamLoader left ResourceLoaderOptions::destination at its
default value of the empty
string, so the CSP check for a plug-in stream fell back to connect-src. Per
CSP3 ยง6.1.9 the loads an
object or embed element makes for its content are governed by object-src.
Previously a page with
"object-src 'self'; connect-src 'none'" had its PDF blocked partway through
incremental loading even
though object-src allowed it.
Plumb a FetchOptions::Destination through schedulePluginStreamLoad() to
NetscapePlugInStreamLoader,
and have PluginView report Embed or Object based on its plug-in element's tag
name so the stream is
matched against object-src.
https://www.w3.org/TR/CSP3/#directive-object-src
Test:
imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/incremental-pdf.py:
Added.
(main):
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/linearized.pdf:
Added.
* Source/WebCore/loader/NetscapePlugInStreamLoader.cpp:
(WebCore::plugInStreamLoaderOptions):
(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
(WebCore::NetscapePlugInStreamLoader::create):
* Source/WebCore/loader/NetscapePlugInStreamLoader.h:
* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:
(WebKit::WebLoaderStrategy::schedulePluginStreamLoad):
* Source/WebKit/WebProcess/Network/WebLoaderStrategy.h:
* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm:
(WebKit::PDFPluginBase::startByteRangeRequest):
* Source/WebKit/WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::Stream::start):
(WebKit::PluginView::fetchDestination const):
* Source/WebKit/WebProcess/Plugins/PluginView.h:
* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.cpp:
(WebResourceLoadScheduler::schedulePluginStreamLoad):
* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h:
Canonical link: https://commits.webkit.org/318797@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
