Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 62a36ef359deece63965b787edd9ec1c9cb76381
https://github.com/WebKit/WebKit/commit/62a36ef359deece63965b787edd9ec1c9cb76381
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name.html
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-expected.txt
M Source/WebCore/dom/Element.cpp
Log Message:
-----------
[CSP] Nonce-based CSP is bypassed by dangling markup placed before a nonced
<link>
https://bugs.webkit.org/show_bug.cgi?id=323021
rdar://185336542
Reviewed by Anne van Kesteren.
Element::isNonceable() implements the CSP "is element nonceable" algorithm
(https://www.w3.org/TR/CSP3/#is-element-nonceable) which officially only checks
for '<script'
and '<style' in each attribute name and value to catch injected dangling markup
and prevent
an unterminated script start tag from stealing a nonce from a legitimate
element.
The algorithm currently doesn't check for '<link' even though <link> is
nonceable.
Fix by also checking for '<link' in each attribute name and value. Nonces apply
only to
script, style and link elements, so all three are now covered. Chrome has
already made this
change and has proposed updating the CSP spec
(https://github.com/w3c/webappsec-csp/pull/810).
A WPT test exists for checking non-nonceable elements
(imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements.html)
and WebKit currently fails its '<link' subtests, which this fix addresses. That
test only
checks attribute values, so add a second similar test to cover attribute names.
Test:
imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-expected.txt:
* Source/WebCore/dom/Element.cpp:
(WebCore::Element::isNonceable const):
Canonical link: https://commits.webkit.org/320263@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
