Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d65bd812f14143e94acb90b84096077e84c09bcc
https://github.com/WebKit/WebKit/commit/d65bd812f14143e94acb90b84096077e84c09bcc
Author: Roberto Rodriguez <[email protected]>
Date: 2026-06-11 (Thu, 11 Jun 2026)
Changed paths:
A
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-blob-url-inherits-csp-importScripts-blocked-expected.txt
A
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-blob-url-inherits-csp-importScripts-blocked.html
A
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-data-url-inherits-csp-importScripts-blocked-expected.txt
A
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-data-url-inherits-csp-importScripts-blocked.html
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/worker-data-set-timeout.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/iframe-blank-inherit.meta/upgrade/sharedworker-import-data.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/fetch.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/websocket.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/xhr.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/fetch.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/websocket.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/xhr.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/fetch.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/websocket.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/xhr.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/fetch.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/websocket.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/xhr.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/srcdoc-inherit.meta/upgrade/sharedworker-import-data.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/top.http-rp/upgrade/sharedworker-import-data.https-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/top.meta/upgrade/sharedworker-import-data.https-expected.txt
M Source/WebCore/workers/shared/SharedWorkerScriptLoader.cpp
Log Message:
-----------
Inherit creating document's CSP for SharedWorkers loaded from headerless URLs
https://bugs.webkit.org/show_bug.cgi?id=308765
rdar://171287542
Reviewed by Ryan Reno.
SharedWorkerScriptLoader::notifyFinished() does not inherit the creating
document's CSP when the worker URL carries no HTTP headers.
Worker::didReceiveResponse() already handles this for DedicatedWorkers by
checking for blob:, file:, and opaque-origin URLs.
Apply the same check in SharedWorkerScriptLoader so that the creating
context's CSP flows into the WorkerFetchResult before it reaches
SharedWorkerGlobalScope.
Tests:
http/tests/security/contentSecurityPolicy/shared-worker-blob-url-inherits-csp-importScripts-blocked.html
http/tests/security/contentSecurityPolicy/shared-worker-data-url-inherits-csp-importScripts-blocked.html
*
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-blob-url-inherits-csp-importScripts-blocked-expected.txt:
Added.
*
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-blob-url-inherits-csp-importScripts-blocked.html:
Added.
*
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-data-url-inherits-csp-importScripts-blocked-expected.txt:
Added.
*
LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-data-url-inherits-csp-importScripts-blocked.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/worker-data-set-timeout.sub-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/iframe-blank-inherit.meta/upgrade/sharedworker-import-data.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/fetch.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/websocket.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.http-rp/upgrade/xhr.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/fetch.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/websocket.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-classic-data.meta/upgrade/xhr.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/fetch.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/websocket.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.http-rp/upgrade/xhr.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/fetch.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/websocket.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/sharedworker-module-data.meta/upgrade/xhr.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/srcdoc-inherit.meta/upgrade/sharedworker-import-data.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/top.http-rp/upgrade/sharedworker-import-data.https-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/upgrade-insecure-requests/gen/top.meta/upgrade/sharedworker-import-data.https-expected.txt:
* Source/WebCore/workers/shared/SharedWorkerScriptLoader.cpp:
(WebCore::SharedWorkerScriptLoader::notifyFinished):
Originally-landed-as: 305413.556@rapid/safari-7624.2.5.110-branch
(7bbbcf272dea). rdar://176062254
Canonical link: https://commits.webkit.org/315016@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
