Title: [274669] trunk/Source/WebCore
- Revision
- 274669
- Author
- [email protected]
- Date
- 2021-03-18 13:26:36 -0700 (Thu, 18 Mar 2021)
Log Message
CSP headers can block default <video> controls
https://bugs.webkit.org/show_bug.cgi?id=223422
<rdar://problem/41192193>
Reviewed by Antoine Quint.
Covered by existing tests.
* Modules/modern-media-controls/controls/icon-service.js:
(IconService.prototype.imageForIconAndLayoutTraits):
In order for an `<img>` to skip CSP checks it must be `isInUserAgentShadowTree` before setting `src`.
* Modules/modern-media-controls/main.js:
(createControls):
Provide the UA `shadowRoot` to the `iconService` so it can temporarily attach the `<img>`.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (274668 => 274669)
--- trunk/Source/WebCore/ChangeLog 2021-03-18 20:16:06 UTC (rev 274668)
+++ trunk/Source/WebCore/ChangeLog 2021-03-18 20:26:36 UTC (rev 274669)
@@ -1,3 +1,21 @@
+2021-03-18 Devin Rousso <[email protected]>
+
+ CSP headers can block default <video> controls
+ https://bugs.webkit.org/show_bug.cgi?id=223422
+ <rdar://problem/41192193>
+
+ Reviewed by Antoine Quint.
+
+ Covered by existing tests.
+
+ * Modules/modern-media-controls/controls/icon-service.js:
+ (IconService.prototype.imageForIconAndLayoutTraits):
+ In order for an `<img>` to skip CSP checks it must be `isInUserAgentShadowTree` before setting `src`.
+
+ * Modules/modern-media-controls/main.js:
+ (createControls):
+ Provide the UA `shadowRoot` to the `iconService` so it can temporarily attach the `<img>`.
+
2021-03-18 Alex Christensen <[email protected]>
Fix a Catalyst build.
Modified: trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js (274668 => 274669)
--- trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js 2021-03-18 20:16:06 UTC (rev 274668)
+++ trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js 2021-03-18 20:26:36 UTC (rev 274669)
@@ -82,11 +82,20 @@
image = this.images[path] = new Image;
+ // Prevent this image from being shown if it's ever attached to the DOM.
+ image.style.display = "none";
+
+ // Must attach the `<img>` to the UA shadow root before setting `src` so that `isInUserAgentShadowTree` is correct.
+ this.shadowRoot?.appendChild(image);
+
if (this.mediaControlsHost)
image.src = "" icon.type)}`;
else
image.src = ""
+ // Remove the `<img>` from the shadow root once the `src` has been set as `isInUserAgentShadowTree` has already been checked by this point.
+ image.remove();
+
return image;
}
Modified: trunk/Source/WebCore/Modules/modern-media-controls/main.js (274668 => 274669)
--- trunk/Source/WebCore/Modules/modern-media-controls/main.js 2021-03-18 20:16:06 UTC (rev 274668)
+++ trunk/Source/WebCore/Modules/modern-media-controls/main.js 2021-03-18 20:26:36 UTC (rev 274669)
@@ -34,7 +34,10 @@
{
if (host) {
mediaControlsHost = host;
+
+ iconService.shadowRoot = shadowRoot;
iconService.mediaControlsHost = host;
+
shadowRoot.appendChild(document.createElement("style")).textContent = host.shadowRootCSSText;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
