1687911 - [wpt-sync] Sync PR 27271 - CSP: Use parsed policies for initializing Workers/Worklets

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 27271 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/27271
Details from upstream follow.

b'Antonio Sartori <[e-mail]>' wrote:

CSP: Use parsed policies for initializing Workers/Worklets

Workers/Worklet need to take into account Content Security Policies,
which are sometimes inherited by the creating document and sometimes
parsed from the HTTP headers directly. At the moment, we are storing
and sending around the raw CSP policies. For example, when a Worker
inherits the CSPs from the creating document, we send the raw strings,
which were just parsed in the document, to the Worker, where they are
parsed a second time.

Not only this multiple parsing of the same policy is superfluous and
can be avoided. It can also create inconsistencies (see the failing WP
test content-security-policy/sandbox/meta-element.sub.html)

This change replaces the raw policies with the parsed CSP types,
avoids multiple parsing, and fixes that test.

Bug: 1021462,1149272
Change-Id: Ib431253419226d6642a086923620b3aba34feb43
Reviewed-on: https://chromium-review.googlesource.com/2636314
WPT-Export-Revision: 69e7578297f0fd3dc3a4a12aa6a4e219444a836d

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=1f015f827b63d3c5e0ed9c98297f59d6e22ef2aa

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=c21c3190e98dde2233f03e143010171929ee56a1

Comment 3

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 15 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests and 1 subtests

Status Summary

Firefox

OK : 1
FAIL: 1

Chrome

OK : 1
FAIL: 1

Safari

OK : 1
FAIL: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

/content-security-policy/script-src/worker-data-set-timeout.sub.html
Shared worker with data: url inherits CSP: FAIL (Chrome: FAIL, Safari: FAIL)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a6dd9c703e83
[wpt PR 27271] - CSP: Use parsed policies for initializing Workers/Worklets, a=testonly
https://hg.mozilla.org/integration/autoland/rev/6d87b739d428
[wpt PR 27271] - Update wpt metadata, a=testonly

Comment 5

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/a6dd9c703e83
https://hg.mozilla.org/mozilla-central/rev/6d87b739d428