Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 46c234678e15965db1e2b936d50cb6861de6e7ee
https://github.com/WebKit/WebKit/commit/46c234678e15965db1e2b936d50cb6861de6e7ee
Author: Roberto Rodriguez <[email protected]>
Date: 2026-07-17 (Fri, 17 Jul 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.html.headers
M Source/WebCore/page/csp/ContentSecurityPolicy.cpp
M Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp
M Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h
Log Message:
-----------
CSP matches a script's content hash even for external scripts under
strict-dynamic
https://bugs.webkit.org/show_bug.cgi?id=319508
rdar://177723577
Reviewed by Ryan Reno.
Under a strict-dynamic policy WebKit checks whether a script's content hash
matches
one of the policy's allowed hashes. This check is meant for inline scripts,
whose content
is known. But it also runs for external scripts, whose content is not yet
available, so their
content is treated as empty. When a policy allows the hash of the empty string,
every
parser-inserted external script matches it and runs, even with no nonce and no
matching
integrity.
Fix by comparing a script's content hash against the policy only when the
script is inline.
An external script still matches an allowed hash through its integrity
attribute, but its empty
body is no longer treated as matching the empty-string hash.
Also rename violatedDirectiveForNonParserInsertedScripts to
violatedDirectiveForScriptUnderStrictDynamic
since the method gates any script under a strict-dynamic policy, not just
non-parser-inserted ones.
Test:
imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.html.headers:
Added.
* Source/WebCore/page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::allowScriptForStrictDynamic const):
* Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp:
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptUnderStrictDynamic
const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts
const): Deleted.
* Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h:
Canonical link: https://commits.webkit.org/317454@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
