aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--components/script/dom/document.rs10
-rw-r--r--components/script/dom/htmlstyleelement.rs16
-rw-r--r--tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-attr-allowed.html.ini7
-rw-r--r--tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-src-allowed.html.ini7
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/injected-inline-style-blocked.sub.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/inline-style-blocked.sub.html.ini7
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/style-src-hash-blocked.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/style-src-hash-case-insensitive.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/style-src-injected-inline-style-blocked.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-blocked.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-nonce-blocked.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/stylehash-basic-blocked.sub.html.ini3
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/stylenonce-allowed.sub.html.ini7
-rw-r--r--tests/wpt/meta/content-security-policy/style-src/stylenonce-blocked.sub.html.ini7
14 files changed, 23 insertions, 59 deletions
diff --git a/components/script/dom/document.rs b/components/script/dom/document.rs
index ae48fa1fb2f..e3590461604 100644
--- a/components/script/dom/document.rs
+++ b/components/script/dom/document.rs
@@ -4307,16 +4307,16 @@ impl Document {
type_: csp::InlineCheckType,
source: &str,
) -> csp::CheckResult {
- let element = csp::Element {
- nonce: el
- .get_attribute(&ns!(), &local_name!("nonce"))
- .map(|attr| Cow::Owned(attr.value().to_string())),
- };
let (result, violations) = match self.get_csp_list() {
None => {
return csp::CheckResult::Allowed;
},
Some(csp_list) => {
+ let element = csp::Element {
+ nonce: el
+ .get_attribute(&ns!(), &local_name!("nonce"))
+ .map(|attr| Cow::Owned(attr.value().to_string())),
+ };
csp_list.should_elements_inline_type_behavior_be_blocked(&element, type_, source)
},
};
diff --git a/components/script/dom/htmlstyleelement.rs b/components/script/dom/htmlstyleelement.rs
index 0deb507f283..194b81729fb 100644
--- a/components/script/dom/htmlstyleelement.rs
+++ b/components/script/dom/htmlstyleelement.rs
@@ -4,6 +4,7 @@
use std::cell::Cell;
+use content_security_policy as csp;
use dom_struct::dom_struct;
use html5ever::{LocalName, Prefix};
use js::rust::HandleObject;
@@ -97,8 +98,21 @@ impl HTMLStyleElement {
return;
}
- let window = node.owner_window();
let doc = self.owner_document();
+
+ // Step 5: If the Should element's inline behavior be blocked by Content Security Policy? algorithm
+ // returns "Blocked" when executed upon the style element, "style",
+ // and the style element's child text content, then return. [CSP]
+ if doc.should_elements_inline_type_behavior_be_blocked(
+ self.upcast(),
+ csp::InlineCheckType::Style,
+ &node.child_text_content(),
+ ) == csp::CheckResult::Blocked
+ {
+ return;
+ }
+
+ let window = node.owner_window();
let data = node
.GetTextContent()
.expect("Element.textContent must be a string");
diff --git a/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-attr-allowed.html.ini b/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-attr-allowed.html.ini
deleted file mode 100644
index c67fec5245c..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-attr-allowed.html.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[style-src-elem-blocked-attr-allowed.html]
- expected: TIMEOUT
- [Should fire a security policy violation for the inline block]
- expected: NOTRUN
-
- [The inline style should not be applied and the attribute style should be applied]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-src-allowed.html.ini b/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-src-allowed.html.ini
deleted file mode 100644
index 06439a8cc0a..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src-attr-elem/style-src-elem-blocked-src-allowed.html.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[style-src-elem-blocked-src-allowed.html]
- expected: TIMEOUT
- [Should fire a security policy violation event]
- expected: NOTRUN
-
- [The inline style should not be applied]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/injected-inline-style-blocked.sub.html.ini b/tests/wpt/meta/content-security-policy/style-src/injected-inline-style-blocked.sub.html.ini
deleted file mode 100644
index 06132f67bfc..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src/injected-inline-style-blocked.sub.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[injected-inline-style-blocked.sub.html]
- [Expecting logs: ["violated-directive=style-src-elem","violated-directive=style-src-elem","PASS"\]]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/inline-style-blocked.sub.html.ini b/tests/wpt/meta/content-security-policy/style-src/inline-style-blocked.sub.html.ini
deleted file mode 100644
index 62bbd2f0e13..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src/inline-style-blocked.sub.html.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[inline-style-blocked.sub.html]
- expected: TIMEOUT
- [Triggers securitypolicyviolation.]
- expected: TIMEOUT
-
- [Inline style element is blocked by CSP.]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/style-src-hash-blocked.html.ini b/tests/wpt/meta/content-security-policy/style-src/style-src-hash-blocked.html.ini
index a79f011aec3..f63f4a41072 100644
--- a/tests/wpt/meta/content-security-policy/style-src/style-src-hash-blocked.html.ini
+++ b/tests/wpt/meta/content-security-policy/style-src/style-src-hash-blocked.html.ini
@@ -1,7 +1,4 @@
[style-src-hash-blocked.html]
expected: TIMEOUT
- [Should not load style that does not match hash]
- expected: FAIL
-
[Should fire a securitypolicyviolation event]
expected: NOTRUN
diff --git a/tests/wpt/meta/content-security-policy/style-src/style-src-hash-case-insensitive.html.ini b/tests/wpt/meta/content-security-policy/style-src/style-src-hash-case-insensitive.html.ini
new file mode 100644
index 00000000000..fe35d3ea411
--- /dev/null
+++ b/tests/wpt/meta/content-security-policy/style-src/style-src-hash-case-insensitive.html.ini
@@ -0,0 +1,3 @@
+[style-src-hash-case-insensitive.html]
+ [All style elements should load because they have proper hashes]
+ expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/style-src-injected-inline-style-blocked.html.ini b/tests/wpt/meta/content-security-policy/style-src/style-src-injected-inline-style-blocked.html.ini
index bb5c48df1b0..d77abcc7908 100644
--- a/tests/wpt/meta/content-security-policy/style-src/style-src-injected-inline-style-blocked.html.ini
+++ b/tests/wpt/meta/content-security-policy/style-src/style-src-injected-inline-style-blocked.html.ini
@@ -1,7 +1,4 @@
[style-src-injected-inline-style-blocked.html]
expected: TIMEOUT
- [Injected style attributes should not be applied]
- expected: FAIL
-
[Should fire a securitypolicyviolation event]
expected: NOTRUN
diff --git a/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-blocked.html.ini b/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-blocked.html.ini
index 33ee0df35af..3884b98ae92 100644
--- a/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-blocked.html.ini
+++ b/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-blocked.html.ini
@@ -1,7 +1,4 @@
[style-src-inline-style-blocked.html]
expected: TIMEOUT
- [Inline style element should not load without 'unsafe-inline']
- expected: FAIL
-
[Should fire a securitypolicyviolation event]
expected: NOTRUN
diff --git a/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-nonce-blocked.html.ini b/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-nonce-blocked.html.ini
index df0fb590691..f2eac484989 100644
--- a/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-nonce-blocked.html.ini
+++ b/tests/wpt/meta/content-security-policy/style-src/style-src-inline-style-nonce-blocked.html.ini
@@ -1,7 +1,4 @@
[style-src-inline-style-nonce-blocked.html]
expected: TIMEOUT
- [Should not load inline style element with invalid nonce]
- expected: FAIL
-
[Should fire a securitypolicyviolation event]
expected: NOTRUN
diff --git a/tests/wpt/meta/content-security-policy/style-src/stylehash-basic-blocked.sub.html.ini b/tests/wpt/meta/content-security-policy/style-src/stylehash-basic-blocked.sub.html.ini
deleted file mode 100644
index 10375077b42..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src/stylehash-basic-blocked.sub.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[stylehash-basic-blocked.sub.html]
- [Expecting alerts: ["PASS: The 'p' element's text is green, which means the style was correctly applied.", "violated-directive=style-src-elem"\]]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/stylenonce-allowed.sub.html.ini b/tests/wpt/meta/content-security-policy/style-src/stylenonce-allowed.sub.html.ini
deleted file mode 100644
index ae2f83c41d8..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src/stylenonce-allowed.sub.html.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[stylenonce-allowed.sub.html]
- expected: TIMEOUT
- [Should fire securitypolicyviolation]
- expected: NOTRUN
-
- [stylenonce-allowed]
- expected: FAIL
diff --git a/tests/wpt/meta/content-security-policy/style-src/stylenonce-blocked.sub.html.ini b/tests/wpt/meta/content-security-policy/style-src/stylenonce-blocked.sub.html.ini
deleted file mode 100644
index 97a86a69eea..00000000000
--- a/tests/wpt/meta/content-security-policy/style-src/stylenonce-blocked.sub.html.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[stylenonce-blocked.sub.html]
- expected: TIMEOUT
- [Should fire securitypolicyviolation]
- expected: NOTRUN
-
- [stylenonce-blocked]
- expected: FAIL