1552504 - iframes blocked by CSP don't fire an onload event

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[James Graham [:jgraham]]

There are several tests under testing/web-platform/tests/content-security-policy/frame-ancestors timing out because they are injecting an iframe and waiting on getting either a load event or an error event. When the iframe load is blocked by CSP we send neither event and the tests stall. In other browsers the tests are able to run to completion (but seem to have other problems that prevent them from passing) [1].

[1] https://wpt.fyi/results/content-security-policy/frame-ancestors?label=master&product=chrome%5Bexperimental%5D&product=edge&product=firefox%5Bexperimental%5D&product=safari%5Bexperimental%5D&aligned

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Once we have fixed Bug 965637, we should re-evulate what we can do here - putting in the backlog for now.

Comment 2

[James Graham [:jgraham]]

The prerequisite was fixed here, and we still have many tests timing out due to this bug, plus obviously doing something different to Chrome seems like a web-compat risk (of course sites shouldn't rely on resources being blocked, but the web is pretty strange). Can we reevaluate the priority here?

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Removing keywords so this shows up in the weekly triage meeting again in order to re-evaluate the priority request.

Comment 4

[Daniel Veditz [:dveditz]]

Anne: one of the specs ought to say what should happen here, right? Maybe the CSP spec, or maybe fetch or HTML? Chrome is issuing one of these because the tests were written to expect it. Should we just copy Chrome, or think about which response is better? We should probably do whatever we do for a 404 so we're not leaking extra information (but Chrome-compat is also good).

Comment 5

[Anne (:annevk)]

See bug 1599256 comment 11. I think we should copy Chrome. (Ideally this would be like a network error, not like a 404 (which is a success for frames), but compatibility wins.)

Comment 6

[Daniel Veditz [:dveditz]]

Changing the summary to "onload" per what chrome does and discussions in the WHATWG issue referenced in bug 1599256.

Comment 7

[Anne (:annevk)]

Note that the fix though should be firing a load event for all network errors, not just CSP-induced network errors.