1935434 - Discard malformed trusted-type policy name in CSP directive instead of ignoring the whole CSP directive

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Mirko Brodesser (:mbrodesser) -- not reading bugmails currently]

See https://github.com/w3c/webappsec-csp/pull/363#issuecomment-2160193577 and
https://github.com/w3c/webappsec-csp/pull/363#issuecomment-2175741520.

Comment 1

[Frederik Braun [:freddy]]

Thanks for filing. Marking as an enhancement, as long as TT is disabled.

Comment 2

[Frédéric Wang (:fredw)]

Attachment: Bug 1935434 Implement forgiving parsing for trusted-types CSP directive. r=smaug

Currently, we just discard the whole directive if an invalid token is
found. With this patch, we instead ignore such a token. Also improves
tests in should-trusted-type-policy-creation-be-blocked-by-csp-002.html
so that we really check that the original trusted-types directive is
preserved after serialization.

See https://github.com/w3c/webappsec-csp/pull/363#issuecomment-2160193577

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3a01a7335e0b
Implement forgiving parsing for trusted-types CSP directive. r=smaug

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/51691 for changes under testing/web-platform/tests

Comment 5

[Cristina Horotan [:chorotan]]

Backed out for causing GTest failures

Backout link

Push with failures

Failure log

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 7

[Frédéric Wang (:fredw)]

These GTest are not up-to-date now that we do forgiving parsing. Updated in the last patch.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d53513a85e73
Implement forgiving parsing for trusted-types CSP directive. r=smaug

Comment 9

[Cristina Horotan [:chorotan]]

Backed out for causing GTest failures

Backout link

Push with failures

Failure log

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f27925f3d6f7
Implement forgiving parsing for trusted-types CSP directive. r=smaug

Comment 12

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/f27925f3d6f7

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot