1706026 - (policy-container) Implement policy inheritance according to policy container

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[antoniosartori]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

Steps to reproduce:

This is an implementation bug tracking this PR on the html spec: https://github.com/whatwg/html/pull/6504

The PR introduces the concept of a policy container, and uses it to clarify inheritance to local schemes for Content Security Policy (as a first step).

It is likely that Firefox needs minor changes to adhere to that PR (see also the tests https://wpt.fyi/results/content-security-policy/inheritance?label=experimental&label=master&aligned). More work could be needed as we add more policies to the policy container.

Comment 1

[Domenic Denicola]

Here is another specific test that fails without policy container: https://wpt.fyi/results/referrer-policy/generic/inheritance/iframe-inheritance-history-about-srcdoc.html?label=experimental&label=master&aligned