Skip to content

Commit 4e0d4eb

Browse files
fred-wangmoz-wptsync-bot
authored andcommitted
Implement forgiving parsing for trusted-types CSP directive.
Currently, we just discard the whole directive if an invalid token is found. With this patch, we instead ignore such a token. Also improves tests in should-trusted-type-policy-creation-be-blocked-by-csp-002.html so that we really check that the original trusted-types directive is preserved after serialization. See w3c/webappsec-csp#363 (comment) Differential Revision: https://phabricator.services.mozilla.com/D243358 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1935434 gecko-commit: 3a01a7335e0b5b05b49cbda19324a9b8a06ab315 gecko-reviewers: smaug
1 parent 3325432 commit 4e0d4eb

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

trusted-types/should-trusted-type-policy-creation-be-blocked-by-csp-002.html

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,8 @@
6363
// https://w3c.github.io/trusted-types/dist/spec/#should-block-create-policy
6464
assert_true(results[0].exception instanceof TypeError, "createPolicy() should throw a TypeError.");
6565
assert_equals(results[0].violatedPolicies.length, 1, "createPolicy() should trigger a violation report.");
66+
assert_equals(results[0].violatedPolicies[0].disposition, "enforce");
67+
assert_equals(results[0].violatedPolicies[0].policy, `trusted-types ${trustedTypePolicyName}`);
6668
}, `invalid tt-policy-name name "${trustedTypePolicyName}"`);
6769
});
6870

@@ -90,5 +92,7 @@
9092
assert_equals(results.length, 1);
9193
assert_true(results[0].exception instanceof TypeError);
9294
assert_equals(results[0].violatedPolicies.length, 1);
95+
assert_equals(results[0].violatedPolicies[0].disposition, "enforce");
96+
assert_equals(results[0].violatedPolicies[0].policy, `trusted-types _TTP_*`);
9397
}, `invalid directive "trusted-type _TTP" (no ascii whitespace)`);
9498
</script>

0 commit comments

Comments
 (0)