1589379 - [wpt-sync] Sync PR 19758 - [Trusted Types] Handle navigation to javascript:-URLs as a TT violation.

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 19758 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/19758
Details from upstream follow.

Daniel Vogelheim <[e-mail]> wrote:

[Trusted Types] Handle navigation to javascript:-URLs as a TT violation.

This adds a second CSP-triggered check when navigating to
javascript:-URLs. Newer Trusted Type spec versions treat this
similar to an assignment to a \<script> tag and run the TT
default policy on it.

The implementation is a bit more complicated, because this is
a TT check that does not normally occur during JS execution.

This updates the TT implementation to the latest spec version.

R=mkwst

Bug: 1002555
Change-Id: I4b815c74c5b9e3e4a11c7cc35c8668d32d2ae7e5
Reviewed-on: https://chromium-review.googlesource.com/1865313
WPT-Export-Revision: 24a0380fcd571117b4ea78d12d8a2ad80305363d

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=607d3b7c195fdfbc376631253fae5c082dfe8da9

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

GitHub CI Results

wpt.fyi PR Results Base Results

Ran 1 tests and 4 subtests

Firefox

TIMEOUT: 2
NOTRUN : 3

Chrome

TIMEOUT: 2
NOTRUN : 3

Safari

TIMEOUT: 2
NOTRUN : 3

New tests that's don't pass

/trusted-types/trusted-types-navigation.tentative.html: Firefox: TIMEOUT, Chrome: TIMEOUT, Safari: TIMEOUT
Navigate a window with javascript:-urls w/ default policy in enforcing mode.: Firefox: NOTRUN, Chrome: NOTRUN, Safari: NOTRUN
Navigate a window with javascript:-urls in report-only mode.: Firefox: NOTRUN, Chrome: NOTRUN, Safari: NOTRUN
Navigate a window with javascript:-urls in enforcing mode.: Firefox: TIMEOUT, Chrome: TIMEOUT, Safari: TIMEOUT
Navigate a window with javascript:-urls w/ default policy in report-only mode.: Firefox: NOTRUN, Chrome: NOTRUN, Safari: NOTRUN

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aff14f0417fa
[wpt PR 19758] - [Trusted Types] Handle navigation to javascript:-URLs as a TT violation., a=testonly
https://hg.mozilla.org/integration/autoland/rev/bcc073752446
[wpt PR 19758] - Update wpt metadata, a=testonly

Comment 4

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/aff14f0417fa
https://hg.mozilla.org/mozilla-central/rev/bcc073752446