Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Is srcdoc aliasing its parent's CSP or copying it? #2594

Closed
bzbarsky opened this issue Apr 26, 2017 · 4 comments
Closed

Is srcdoc aliasing its parent's CSP or copying it? #2594

bzbarsky opened this issue Apr 26, 2017 · 4 comments
Labels
integration

Comments

@bzbarsky
Copy link
Contributor

It's not entirely clear to me from the spec. https://w3c.github.io/webappsec-csp/#initialize-document-csp is aliasing things from parent/opener but not explicitly aliasing things from the response. And the response creation at https://html.spec.whatwg.org/multipage/embedded-content.html#process-the-iframe-attributes in the srcdoc case doesn't make it clear whether the CSP list is set by value or by reference...
@annevk
Copy link
Member

annevk commented Oct 11, 2018

@andypaicu you could probably help solve this somehow, if it isn't already solved.

@andypaicu
Copy link
Contributor

Oh I think we discussed this in w3c/webappsec-csp#207.

It's a copy never a reference.

The spec has been updated since to be more clear.

@annevk
Copy link
Member

annevk commented Oct 11, 2018

Ah, thanks. So what remains is that HTML needs to use https://infra.spec.whatwg.org/#list-clone on the CSP list and not just set it to the iframe element's node document.

@annevk
Copy link
Member

annevk commented Oct 11, 2018

I'll PR.

annevk added a commit that referenced this issue Oct 11, 2018
@annevk
Clone <iframe srcdoc>'s node document's CSP list
151f2e5 
See w3c/webappsec-csp#207 for context.

Tests: ???

Fixes #2594.
@annevk annevk mentioned this issue Oct 11, 2018
Merged
annevk added a commit that referenced this issue Oct 12, 2018
@annevk
Clone <iframe srcdoc>'s node document's CSP list
ebf6d40 
See w3c/webappsec-csp#207 for context.

Tests: web-platform-tests/wpt#8520.

Fixes #2594.
mustaqahmed pushed a commit to mustaqahmed/html that referenced this issue Feb 15, 2019
@annevk @mustaqahmed
Clone <iframe srcdoc>'s node document's CSP list
8dfc6c2 
See w3c/webappsec-csp#207 for context.

Tests: web-platform-tests/wpt#8520.

Fixes whatwg#2594.
mustaqahmed pushed a commit to mustaqahmed/html that referenced this issue Feb 15, 2019
@annevk @mustaqahmed
Clone <iframe srcdoc>'s node document's CSP list
c07a766 
See w3c/webappsec-csp#207 for context.

Tests: web-platform-tests/wpt#8520.

Fixes whatwg#2594.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
integration
Milestone
No milestone
Development

No branches or pull requests
3 participants
@bzbarsky @annevk @andypaicu