1712690 - Update SecurityPolicyViolationEvent WebIDL

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[zyscoder]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Steps to reproduce:

(1) Open a tab and navigate to any URL;
(2) Run the following code in the Console of Devtools:

new SecurityPolicyViolationEvent('', {});

(3) Then this code would be evaluated successfully without throwing any exception.

Actual results:

This code is evaluated successfully without throwing any exception.

Expected results:

As https://docs.w3cub.com/dom/securitypolicyviolationevent/securitypolicyviolationevent says, "eventInitDict is a dictionary object containing information about the properties of the SecurityPolicyViolationEvent to be constructed. This can include the following properties, but bear in mind that if you do include an eventInitDict, certain properties must be included (marked below with required, like disposition)."
That means the code above should throw an exception since the required members are undefined, just like what the Chrome would throw: Uncaught TypeError: Failed to construct 'SecurityPolicyViolationEvent': required member disposition is undefined.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'DevTools::Console' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

This isn't a DevTools issue, you can see the constructor not throwing with:
data:text/html,<meta charset=utf8><script>try { new SecurityPolicyViolationEvent('', {}); alert("ok") } catch(e) { alert("error") }</script>

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

This needs to block Bug 1231788, but we gotta have to put it in the backlog for now. Thanks for reporting though!

Comment 4

[Tom Schuster]

Attachment: Bug 1712690 - Update the SecurityPolicyViolationEvent WebIDL. r?#webidl,#dom-core

I didn't change any of the DOMString instances to USVString.

Comment 5

[Tom Schuster]

The WebIDL in the spec is problematic and will likely be changed to something that is closer to ours.

Comment 6

[Tom Schuster]

The WebIDL was just updated and now almost matches our IDL. https://github.com/w3c/webappsec-csp/pull/645

Comment 7

[Tom Schuster]

Attachment: Bug 1712690 - Update the SecurityPolicyViolationEvent WebIDL. r?#webidl,#dom-core

Implements the changes from https://github.com/w3c/webappsec-csp/pull/645

(This still does not include changing DOMString to USVString)

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0b0b033136dc
Update the SecurityPolicyViolationEvent WebIDL. r=webidl,dom-core,peterv

Comment 9

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/0b0b033136dc