1468173 - [wpt-sync] Sync PR 11457 - Completed 'unsafe-hashes' per spec

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 11457 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/11457
Details from upstream follow.

Andy Paicu <[e-mail]> wrote:
>  Completed 'unsafe-hashes' per spec
>  
>  'unsafe-hashed-attributes' renamed to 'unsafe-hashes'
>  'unsafe-hashes' matches style attributes correctly now
>  'unsafe-hashes' works for javascript: URLs
>  'unsafe-hashes' tests added and ammended
>  
>  spec (approved and to be submitted at the same time as this CR):
>  https://github.com/w3c/webappsec-csp/pull/311
>  
>  Bug: 771922
>  Change-Id: I018cc0f73d492cb4057ff4c41d9be4df8438036c
>  
>  Reviewed-on: https://chromium-review.googlesource.com/1095217
>  WPT-Export-Revision: fcf4f46b43b2b5a038cc7ed9dd55c9348ff70d10

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=e08e896f32241959c03663f8af0aab7401448b42

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=370cf28dc08c4dd05735fddcddcdadc53648845c

Comment 3

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=b0a627395a7a325cb24d472d96b045b197890163

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=931df080180efc00e56d958d3e5594ad0727232a

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=b90da1bb3c94b54e746dcdf246b83c1132fd70b8

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=55c33e7519e743524829eeb7f530ab606be671c2

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=43fe26cd50f4a53c3830466e3f306702c7f43163

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Ran 21 tests and 37 subtests
OK     : 16
PASS   : 5
FAIL   : 18
TIMEOUT: 3
ERROR  : 4
NOTRUN : 12

New tests that have failures or other problems:
/content-security-policy/embedded-enforcement/subsumption_algorithm-unsafe_hashes.html: ERROR
    Effective policy is properly found where 'unsafe-hashes' is not subsumed.: FAIL
    No other keyword has the same effect as 'unsafe-hashes'.: FAIL
    Other expressions have to be subsumed.: FAIL
    Required csp must allow 'unsafe-hashes'.: FAIL
/content-security-policy/unsafe-hashes/javascript_src_allowed-href.html
    Test that the javascript: src is allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_allowed-href_blank.html
    Test that the javascript: src is allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_allowed-window_location.html
    Test that the javascript: src is allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_allowed-window_open.html
    Test that the javascript: src is allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_open.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href_blank.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_open.html
    Test that the javascript: src is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/script_event_handlers_allowed.html
    Test that the inline event handler is allowed to run: FAIL
/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.html
    Test that the inline event handler is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/script_event_handlers_denied_wrong_hash.html
    Test that the inline event handler is not allowed to run: FAIL
/content-security-policy/unsafe-hashes/style_attribute_allowed.html: ERROR
    Test that the inline style attribute is loaded: NOTRUN
/content-security-policy/unsafe-hashes/style_attribute_denied_missing_unsafe_hashes.html: TIMEOUT
    Test that the inline style attribute is blocked: NOTRUN
/content-security-policy/unsafe-hashes/style_attribute_denied_wrong_hash.html
    Test that the inline style attribute is blocked: FAIL

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=38aa3971488ac80e0a0ed8e5bc4df8ab0b7803c1

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/08ae28934584
[wpt PR 11457] - Completed 'unsafe-hashes' per spec, a=testonly
https://hg.mozilla.org/integration/mozilla-inbound/rev/948f128a6992
[wpt PR 11457] - Update wpt metadata, a=testonly

Comment 11

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/08ae28934584
https://hg.mozilla.org/mozilla-central/rev/948f128a6992