1627263 - [rel=preload] Propagate "nonce" attribute from <link preload> to loaders

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P3)

Comment 1

[Honza Bambas (:mayhemer)]

The current state for CSS is: for a speculative load (which is also a link preload), we don't set 'nonce' for the CSP initial check and hence we don't even start that load. This will rule out link preload. Adding the nonce handling is an optimization. The current state doesn't impose any security issue.

The current state for script: we also add nonce only for non-speculative loads.

This bug turns to be an optimization only, but as rel=preload is, as a whole, a performance feature, this should be done as part of M3.

Comment 2

[Tom Schuster]

By not supporting the nonce attribute for speculative <script> loads we would actually trigger CSP error reports in some cases, but bug 1505412 added a very targeted work around for that case. I don't want to replicate this workaround in bug 1313937 when more closely following the specification.

Currently I my patch exclusively supports <script src=".." nonce="..">, because it wasn't totally clear to me if the <link> element really supports nonce. Extending the patch however should be fairly straight forward.

Comment 3

[Tom Schuster]

Attachment: Bug 1627263 - Add nonce attribute to HTML parser.

Depends on D182564

Comment 4

[Tom Schuster]

Attachment: WIP: Bug 1627263 - Provide the nonce for speculative <script> preloads.

Depends on D182777

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dd6b4605ab60
Add nonce attribute to HTML parser. r=hsivonen

Comment 6

[Noemi Erli[:noemi_erli]]

Backed out changeset dd6b4605ab60 (Bug 1627263) for causing bustages in nsHtml5StackNode.h CLOSED TREE

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&collapsedPushes=842382&selectedTaskRun=ZzLSJrfkSW-iU2LW2lPxmw.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=dd6b4605ab6081806f305ce27007b9707000d07d

Log: https://treeherder.mozilla.org/logviewer?job_id=421871562&repo=autoland&lineNumber=53078

Backout: https://hg.mozilla.org/integration/autoland/rev/9d7771114693772e8ab22a98b22b8332da4ea88d

Comment 7

[Tom Schuster]

So seems like these unexpected changes in the C++ code do cause problems. Additionally I am going to move this to another bug, so we don't have to leave-open this one.

Comment 8

[Phabricator Automation]

Comment on attachment 9342346 [details]
Bug 1627263 - Add nonce attribute to HTML parser.

Revision D182777 was moved to bug 1842199. Setting attachment 9342346 [details] to obsolete.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/24e6bd152417
Add nonce attribute to HTML parser. r=hsivonen

Comment 10

[Cristina Horotan [:chorotan]]

Backed out changeset 24e6bd152417 (Bug 1627263) as requested because it landed with the wrong bug number

Backout: https://hg.mozilla.org/integration/autoland/rev/ce73b773910f16b44bcb33f19a119d0a5bc40665

Comment 11

[Phabricator Automation]

Comment on attachment 9342346 [details]
Bug 1627263 - Add nonce attribute to HTML parser.

Revision D182777 was moved to bug 1842199. Setting attachment 9342346 [details] to obsolete.

Comment 12

[Tom Schuster]

Attachment: Bug 1627263 - Provide the nonce for speculative style preloads. r?smaug

Depends on D183965

Comment 13

[Tom Schuster]

Attachment: Bug 1627263 - Propagate nonce attribute from <link preload> to loaders. r?smaug

Depends on D183966

Comment 14

[Tom Schuster]

Attachment: Bug 1627263 - Propagate nonce attribute from Link header preloads to loaders. r?smaug!,#necko-reviewers!

Depends on D183967

Comment 15

[Tom Schuster]

Attachment: Bug 1627263 - Add a WPT test for <link> with and without nonce. r?smaug

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e68b7692d21a
Provide the nonce for speculative style preloads. r=smaug
https://hg.mozilla.org/integration/autoland/rev/90cf5ca642be
Propagate nonce attribute from <link preload> to loaders. r=smaug
https://hg.mozilla.org/integration/autoland/rev/66db18e3f66d
Propagate nonce attribute from Link header preloads to loaders. r=necko-reviewers,kershaw
https://hg.mozilla.org/integration/autoland/rev/4fe288b36d3a
Add a WPT test for <link> with and without nonce. r=smaug

Comment 17

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/41245 for changes under testing/web-platform/tests

Comment 18

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/e68b7692d21a
https://hg.mozilla.org/mozilla-central/rev/90cf5ca642be
https://hg.mozilla.org/mozilla-central/rev/66db18e3f66d
https://hg.mozilla.org/mozilla-central/rev/4fe288b36d3a

Comment 19

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot