Add WebDriver BiDi CSP bypass hooks#12711
Open
juliandescottes wants to merge 1 commit into
Open
Conversation
This PR updates the HTML spec to check whether CSP is bypassed via WebDriver BiDi configuration for the relevant navigable. Add an optional navigable-or-null parameter (default null) to "clone a policy container", "create a policy container from a fetch response", and "determine navigation params policy container", and skip populating/copying CSP policies when WebDriver BiDi CSP is bypassed for the given navigable. Thread the navigable through from "navigate" and "create navigation params by fetching", the two call sites that have one available. Also guard the `<meta http-equiv="Content-Security-Policy">` processing steps the same way, since meta-injected policies bypass the fetch response path entirely. This depends on the WebDriver BiDi CSP is bypassed algorithm (https://w3c.github.io/webdriver-bidi/#webdriver-bidi-csp-is-bypassed), merged in w3c/webdriver-bidi#1068
Author
|
This is spawned from w3c/webappsec-csp#799 where I wanted to integrate the CSP disabled webdriver BiDi hooks in the CSP specs. The suggestion was to handle that in the HTML spec instead, so I am proposing this PR here. cc @zcorpan , can you have a look? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds optional navigable-or-null parameter to "clone a policy container", "create a policy container from a fetch response", and "determine navigation params policy container", and skip populating/copying CSP policies when WebDriver BiDi CSP is bypassed for the given navigable.
Depends on the WebDriver BiDi CSP is bypassed algorithm (https://w3c.github.io/webdriver-bidi/#webdriver-bidi-csp-is-bypassed), merged in w3c/webdriver-bidi#1068
Known gap in the current PR: not trying to handle workers. For dedicated and shared workers, we can retrieve corresponding navigables and call the WebDriver BiDi hook. For service workers, we would need to check whether CSP is bypassed globally. I would like to get feedback first before implementing this.
(See WHATWG Working Mode: Changes for more details.)
/acknowledgements.html ( diff )
/browsers.html ( diff )
/browsing-the-web.html ( diff )
/infrastructure.html ( diff )
/semantics.html ( diff )