1662412 - [wpt-sync] Sync PR 25322 - Fix CSP source list intersection for CSPEE in blink

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 25322 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/25322
Details from upstream follow.

b'Antonio Sartori <[e-mail]>' wrote:

Fix CSP source list intersection for CSPEE in blink

As explained in https://github.com/w3c/webappsec-cspee/pull/18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://.com and http://.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/2385458
WPT-Export-Revision: 85aa30414d5a800085529cd121bc81d623f46e01

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=9e46011e8016e08fa00bf6f3eb242a8fcbd43b3f

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests and 11 subtests

Status Summary

Firefox

OK : 1
PASS : 6
FAIL : 5

Chrome

PASS : 10
TIMEOUT: 2

Safari

OK : 1
PASS : 6
FAIL : 5

Links

GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

/content-security-policy/embedded-enforcement/subsumption_algorithm-general.html
Iframe with empty returned CSP should be blocked.: FAIL (Chrome: PASS, Safari: FAIL)
Iframe with less restricting CSP should be blocked.: FAIL (Chrome: PASS, Safari: FAIL)
Iframe with a different CSP should be blocked.: FAIL (Chrome: PASS, Safari: FAIL)
Iframe should block if intersection allows sources which are not in required_csp.: FAIL (Chrome: PASS, Safari: FAIL)
Iframe should block if intersection allows sources which are not in required_csp (other ordering).: FAIL (Chrome: PASS, Safari: FAIL)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1bc560f22f12
[wpt PR 25322] - Fix CSP source list intersection for CSPEE in blink, a=testonly

Comment 4

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/1bc560f22f12