From 89532082ea308a7a68fdf6e20c64f12ea3d4e703 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Mon, 27 Jan 2025 13:24:06 +0900 Subject: [PATCH 1/2] Fix CSP navigation request blocking Closes #10796, by passing along the intended snapshotted source CSP instead of attempting to look up the policy container from the request (which will not work when it's left as "client"). --- source | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/source b/source index d0d75d360ce..41148c55b1e 100644 --- a/source +++ b/source @@ -100144,8 +100144,8 @@ location.href = '#foo';
sourceDocument's relevant settings object
source policy container
-
sourceDocument's policy - container
+
a clone of sourceDocument's policy container
@@ -102782,9 +102782,10 @@ location.href = '#foo';

  • If the result of should navigation request of type be blocked by Content Security - Policy? given request and cspNavigationType is "Blocked", then set response to a network error and - break. CSP

    • + Policy? given request, sourceSnapshotParams's source policy container, and + cspNavigationType is "Blocked", then set response + to a network error and break. CSP

  • Set response to null.

    • From e88eb0a620b830baa6dc74ad87226514a69a2cb5 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Tue, 28 Jan 2025 15:40:36 +0900 Subject: [PATCH 2/2] Pass CSP list instead, and fix another call site. --- source | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/source b/source index 41148c55b1e..b511c33d593 100644 --- a/source +++ b/source @@ -100541,8 +100541,9 @@ location.href = '#foo';

  • Queue a global task on the navigation and traversal task source given navigable's active window to navigate to a javascript: URL given navigable, - url, historyHandling, initiatorOriginSnapshot, - userInvolvement, and cspNavigationType.

    • + url, historyHandling, sourceSnapshotParams, + initiatorOriginSnapshot, userInvolvement, and + cspNavigationType.

  • Return.

    • @@ -100915,8 +100916,9 @@ location.href = '#foo';

    To navigate to a javascript: URL, given a navigable targetNavigable, a URL url, a history handling - behavior historyHandling, an origin initiatorOrigin, a - user navigation involvement userInvolvement, and a string + behavior historyHandling, a source snapshot params + sourceSnapshotParams, an origin initiatorOrigin, a user + navigation involvement userInvolvement, and a string cspNavigationType:

      @@ -100938,7 +100940,9 @@ location.href = '#foo';

    1. If the result of should navigation request of type be blocked by Content Security - Policy? given request and cspNavigationType is " given request, cspNavigationType, and + sourceSnapshotParams's source + policy container's CSP list is "Blocked", then return. CSP

    2. Let newDocument be the result of source policy container, and - cspNavigationType is "Blocked", then set response - to a network error and break. CSP

      3. + Policy? given request, cspNavigationType, and + sourceSnapshotParams's source + policy container's CSP list is "Blocked", then set response to a network error and + break. CSP

    3. Set response to null.