1273241 - Several CSP web platform tests are failing after the latest update from bug 1273176

Status: NEW

(Testing :: web-platform-tests, defect)

Description

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I'm going to be disabling them shortly.

Comment 1

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/13238d8c6816

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I'm sure there's a more precise way to disable these on only the affected platforms, but they're currently holding the tree closed.

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/13238d8c6816

Comment 4

[Boris Zbarsky [:bzbarsky]]

This probably needs triage from the security team...

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Boris Zbarsky [:bz] (still a bit busy) (if a patch has no decent message, automatic r-) from comment #4)
> This probably needs triage from the security team...

Thanks for letting me know. I'll have someone look at that.

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Francois, Wennie mentioned you might be able to take a look at this one. If not, please let me know!

Comment 7

[François Marier [:francois]]

Here's what I found so far.

Tests that fail:

https://github.com/w3c/web-platform-tests/blob/master/content-security-policy/blink-contrib/self-doesnt-match-blob.sub.html
https://github.com/w3c/web-platform-tests/blob/master/content-security-policy/blink-contrib/star-doesnt-match-blob.sub.html
https://github.com/w3c/web-platform-tests/blob/master/content-security-policy/blink-contrib/worker-connect-src-allowed.sub.html
https://github.com/w3c/web-platform-tests/blob/master/content-security-policy/blink-contrib/worker-script-src.sub.html

I suspect they fail because we lack SecurityPolicyViolationEvent (bug 1302962). I've got too much on this week and next, but I'll try to confirm after that.

Tests that are no longer in the upstream repo:

testing/web-platform/meta/content-security-policy/frame-ancestors/multiple-frames-meta-ignored.sub.html.ini
testing/web-platform/meta/content-security-policy/frame-ancestors/multiple-frames-self-allowed.sub.html.ini
testing/web-platform/meta/content-security-policy/frame-ancestors/single-frame-self-allowed.sub.html.ini

They have been replaced with new ones, so it's probably not worth looking into these.

Comment 8

[Andrea Marchesini [:baku]]

Also with SecurityPolicyViolationEvent enabled, these blob tests fail because we don't 'rename' directives.
See: https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request

SecurityPolicyViolation event should report 'worker-src' as violation-directive, but we report 'child-src' instead.

Comment 9

[Andrea Marchesini [:baku]]

Do we have a bug filed for the naming of CSP directives?

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Andrea Marchesini [:baku] from comment #9)
> Do we have a bug filed for the naming of CSP directives?

I suppose that should be Bug 1192684 - Content Security Policy reports should include "effective-directive" and "status-code".

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:jgraham, maybe it's time to close this bug?

Comment 12

[James Long]

Attachment: softzebtoufan19872730.txt

Thanks from spectacotru1985.