Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4b27da2d753db638a6010b9240b1c15e6e7f3fbc
https://github.com/WebKit/WebKit/commit/4b27da2d753db638a6010b9240b1c15e6e7f3fbc
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheet-cross-origin-redirect-quirks.sub-expected.txt
M Source/WebCore/css/StyleRuleImport.cpp
M Source/WebCore/css/StyleRuleImport.h
M Source/WebCore/css/StyleSheetContents.cpp
M Source/WebCore/css/StyleSheetContents.h
M Source/WebCore/dom/ProcessingInstruction.cpp
M Source/WebCore/dom/ProcessingInstruction.h
M Source/WebCore/html/HTMLLinkElement.cpp
M Source/WebCore/html/HTMLLinkElement.h
M Source/WebCore/loader/LinkPreloadResourceClients.h
M Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
M Source/WebCore/loader/cache/CachedStyleSheetClient.h
Log Message:
-----------
Cross-origin redirect should disable the quirks-mode CSS MIME type sniffing
quirk even when the final URL is same-origin
https://bugs.webkit.org/show_bug.cgi?id=323533
rdar://186771732
Reviewed by Chris Dumez.
This patch aligns WebKit with Gecko / Firefox.
The quirks-mode quirk that assumes text/css for a stylesheet served with an
unsupported Content-Type only applies when the document "has the same origin as
the URL of the external resource" [1]. A response tainted by a cross-origin
redirect is not same-origin for this purpose, even when the redirect chain lands
back on a same-origin URL.
StyleSheetContents::parseAuthorStyleSheet() derived isSameOriginRequest only
from canRequest(baseURL()), i.e. the final response URL, so a cross-origin
redirect back to same-origin was treated as same-origin and given the lax
(quirks) MIME type check. The stylesheet was applied and fired "load" instead
of "error". Also require the response not to be cross-origin (tainting is Basic)
before applying the lax check.
The CachedCSSStyleSheet argument is always non-null: it is always the sheet
itself (this) at the sole notification sites in CachedCSSStyleSheet, and every
CachedStyleSheetClient::setCSSStyleSheet() override dereferenced it
unconditionally. To make that non-null contract explicit end-to-end, the
setCSSStyleSheet() interface and parseAuthorStyleSheet() now take a C++
reference instead of a raw pointer.
[1] https://html.spec.whatwg.org/#link-type-stylesheet
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheet-cross-origin-redirect-quirks.sub-expected.txt:
Progression
* Source/WebCore/css/StyleRuleImport.cpp:
(WebCore::StyleRuleImport::setCSSStyleSheet):
* Source/WebCore/css/StyleRuleImport.h:
* Source/WebCore/css/StyleSheetContents.cpp:
(WebCore::StyleSheetContents::parseAuthorStyleSheet):
* Source/WebCore/css/StyleSheetContents.h:
* Source/WebCore/dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::setCSSStyleSheet):
* Source/WebCore/dom/ProcessingInstruction.h:
* Source/WebCore/html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::setCSSStyleSheet):
* Source/WebCore/html/HTMLLinkElement.h:
* Source/WebCore/loader/LinkPreloadResourceClients.h:
* Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp:
(WebCore::CachedCSSStyleSheet::didAddClient):
(WebCore::CachedCSSStyleSheet::checkNotify):
* Source/WebCore/loader/cache/CachedStyleSheetClient.h:
Canonical link: https://commits.webkit.org/321229@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
