зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1637195 [wpt PR 23525] - Remove the `[SecureContext]` restriction from Trusted Types., a=testonly
Automatic update from web-platform-tests Remove the `[SecureContext]` restriction from Trusted Types. While it's reasonable to exclude new APIs from non-secure contexts, the ancestry requirements allow attackers to disable restricted APIs from embedded contexts. This is usually excellent, as it means that data won't leak from secure to non-secure contexts. For security features, on the other hand, this gives the attacker some advantage with regard to embedded contexts' mitigtions. This is unfortunate, and this patch removes the restriction to ensure that embedded contexts can continue to mitigate the effect of XSS attack by reverting https://crrev.com/c/2093214 and https://crrev.com/c/2098076. Bug: 1059554 Change-Id: Ib948437310509f1d29cacff1e6c74ab7cbc30d11 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2195965 Commit-Queue: Mike West <mkwst@chromium.org> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org> Cr-Commit-Position: refs/heads/master@{#767894} -- wpt-commits: 094353fedf808caf83e82b4959b5edf02e1be92e wpt-pr: 23525
This commit is contained in:
Mike West
moz-wptsync-bot
Родитель
e0b8d1b5b7
Коммит
84c3aac2d2
|
|
@ -201,8 +201,8 @@ SET TIMEOUT: service-workers/service-worker/resources/resource-timing-worker.js
|
|||
SET TIMEOUT: shadow-dom/Document-prototype-currentScript.html
|
||||
SET TIMEOUT: shadow-dom/scroll-to-the-fragment-in-shadow-tree.html
|
||||
SET TIMEOUT: shadow-dom/slotchange-event.html
|
||||
SET TIMEOUT: trusted-types/block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.tentative.https.html
|
||||
SET TIMEOUT: trusted-types/DOMWindowTimers-setTimeout-setInterval.tentative.https.html
|
||||
SET TIMEOUT: trusted-types/block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.tentative.html
|
||||
SET TIMEOUT: trusted-types/DOMWindowTimers-setTimeout-setInterval.tentative.html
|
||||
SET TIMEOUT: user-timing/*
|
||||
SET TIMEOUT: web-animations/timing-model/animations/*
|
||||
SET TIMEOUT: webaudio/the-audio-api/the-mediaelementaudiosourcenode-interface/mediaElementAudioSourceToScriptProcessorTest.html
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
<!DOCTYPE html>
|
||||
<head>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">
|
||||
</head>
|
||||
<body>
|
||||
<script>
|
||||
const testCases = [
|
||||
["script", "src"],
|
||||
["div", "innerHTML"],
|
||||
["script", "text"],
|
||||
];
|
||||
|
||||
testCases.forEach(c => {
|
||||
const name = `${c[0]}.${c[1]} `;
|
||||
test(t => {
|
||||
s = document.createElement(c[0]);
|
||||
s[c[1]] = "https://example.com/";
|
||||
assert_equals("https://example.com/", s[c[1]].toString());
|
||||
}, name + "without trusted types is not blocked by require-trusted-types-for on non-secure pages");
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
|
|
@ -1 +0,0 @@
|
|||
Content-Security-Policy: require-trusted-types-for 'script'
|
||||
Загрузка…
Ссылка в новой задаче