-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add web platform test for CSP frame-ancestors with path #49722
Conversation
The CSP frame-ancestors checking algorithm matches the frame ancestor's origin against the source list. An origin will never match a URL with a path in the source list. Hence this CL adds a web platform test checking that frame loads are blocked if frame-ancestors includes a URL with a path. Bug: 40780874 Change-Id: I33a461a1f69b040d8a5e803978161352821d4161 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6094569 Reviewed-by: Antonio Sartori <antoniosartori@chromium.org> Commit-Queue: Emily Stark <estark@chromium.org> Cr-Commit-Position: refs/heads/main@{#1397345}
5d9fc00
to
05158d8
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The review process for this patch is being conducted in the Chromium project.
WPT Command: Some affected tests had inconsistent (flaky) results: Unstable results
These may be pre-existing or new flakes. Please try to reproduce (see the above WPT command, though some flags may not be needed when running locally) and determine if your change introduced the flake. If you are unable to reproduce the problem, please tag |
created https://crbug.com/385786172 |
The CSP frame-ancestors checking algorithm matches the frame ancestor's origin against the source list. An origin will never match a URL with a path in the source list. Hence this CL adds a web platform test checking that frame loads are blocked if frame-ancestors includes a URL with a path. Bug: 40780874 Change-Id: I33a461a1f69b040d8a5e803978161352821d4161 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6094569 Reviewed-by: Antonio Sartori <antoniosartori@chromium.org> Commit-Queue: Emily Stark <estark@chromium.org> Cr-Commit-Position: refs/heads/main@{#1397345} Co-authored-by: Emily Stark <estark@google.com>
The CSP frame-ancestors checking algorithm matches the frame
ancestor's origin against the source list. An origin will never match
a URL with a path in the source list. Hence this CL adds a web
platform test checking that frame loads are blocked if frame-ancestors
includes a URL with a path.
Bug: 40780874
Change-Id: I33a461a1f69b040d8a5e803978161352821d4161
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6094569
Reviewed-by: Antonio Sartori <antoniosartori@chromium.org>
Commit-Queue: Emily Stark <estark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1397345}