haikuwebkit/LayoutTests/security/contentSecurityPolicy
Rob Buis 1205f912cd WebKit doesn't parse "#" as delimiter for fragment identifier in data URIs
https://bugs.webkit.org/show_bug.cgi?id=68089

Patch by Rob Buis <rbuis@igalia.com> on 2020-10-05
Reviewed by Alex Christensen, Ryosuke Niwa, and Darin Adler.

LayoutTests/imported/w3c:

Update improved test results.

* web-platform-tests/fetch/data-urls/processing.any-expected.txt:
* web-platform-tests/fetch/data-urls/processing.any.worker-expected.txt:
* web-platform-tests/url/data-uri-fragment-expected.txt:

Source/WebCore:

To maintain compatibility with existing iOS and macOS apps, we only do this for apps linked
with the SDK after the change.

Covered by newly passing web platform tests (which Chrome and Firefox already passed).

* loader/ResourceLoader.cpp:
(WebCore::shouldStripFragmentIdentifier):
(WebCore::ResourceLoader::loadDataURL):
* platform/cocoa/VersionChecks.h:

Source/WTF:

* wtf/URL.h:
* wtf/spi/darwin/dyldSPI.h:

LayoutTests:

Adjusts tests thats use data URIs to escape the # character.

* accessibility/ios-simulator/iframe-access.html:
* accessibility/ios-simulator/unobscured-content-rect.html:
* accessibility/resources/iframe.html:
* accessibility/scroll-to-global-point-iframe.html:
* accessibility/scroll-to-make-visible-iframe-offscreen.html:
* accessibility/scroll-to-make-visible-iframe.html:
* css3/blending/background-blend-mode-crossfade-image.html:
* css3/blending/background-blend-mode-data-uri-svg-image.html:
* css3/blending/background-blend-mode-tiled-layers.html:
* css3/flexbox/flexitem.html:
* css3/shapes/shape-outside/shape-image/shape-image-002.html:
* css3/shapes/shape-outside/shape-image/shape-image-005.html:
* editing/pasteboard/data-transfer-set-data-sanitize-url-when-copying-in-null-origin.html:
* editing/pasteboard/data-transfer-set-data-sanitize-url-when-dragging-in-null-origin.html:
* fast/css-grid-layout/grid-item-display.html:
* fast/css/import-style-update.html:
* fast/css/link-media-attr.html:
* fast/dom/HTMLLinkElement/link-stylesheet-media-type.html:
* fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html:
* fast/events/attribute-listener-cloned-from-frameless-doc-context.html:
* fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html:
* fast/events/attribute-listener-extracted-from-frameless-doc-context.html:
* fast/hidpi/image-srcset-data-escaped-srcset.html:
* fast/html/link-rel-stylesheet.html:
* fast/loader/data-url-encoding-html.html:
* fast/loader/data-url-encoding-svg.html:
* fast/spatial-navigation/resources/iframe.html:
* http/tests/security/top-level-unique-origin.https.html:
* platform/ios/css3/flexbox/flexitem-expected.txt:
* platform/win/css3/flexbox/flexitem-expected.txt:
* security/contentSecurityPolicy/link-with-data-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html:
* svg/animations/css-animation-background-svg.html:
* svg/animations/css-animation-embedded-svg.html:
* svg/animations/css-animation-hover-svg.html:
* svg/as-image/svg-canvas-data-url-svg-with-feimage-not-tainted.html:
* svg/custom/object-data-href.html:



Canonical link: https://commits.webkit.org/230098@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267995 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-10-05 19:36:22 +00:00
..
resources
blocks-video-expected.txt Move most of CSP tests into security/contentSecurityPolicy/ 2016-06-17 00:45:42 +00:00
blocks-video.html
font-loading-block-all-expected.txt
font-loading-block-all.html
image-with-blob-url-allowed-by-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
image-with-blob-url-allowed-by-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
image-with-blob-url-blocked-by-img-src-star-expected.html
image-with-blob-url-blocked-by-img-src-star.html
image-with-data-url-allowed-by-img-src-star-expected.html
image-with-data-url-allowed-by-img-src-star.html
image-with-file-url-allowed-by-img-src-star-expected.html
image-with-file-url-allowed-by-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
image-with-file-url-allowed-by-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
image-with-file-url-allowed-by-img-src-star.html
link-with-blob-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
link-with-blob-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
link-with-blob-url-blocked-by-style-src-star-expected.html
link-with-blob-url-blocked-by-style-src-star.html
link-with-data-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
link-with-data-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
link-with-data-url-blocked-by-style-src-star-expected.html
link-with-data-url-blocked-by-style-src-star.html
link-with-file-url-allowed-by-style-src-star-expected.html
link-with-file-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
link-with-file-url-allowed-by-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
link-with-file-url-allowed-by-style-src-star.html
object-src-none-blocks-quicktime-plugin-replacement-expected.txt
object-src-none-blocks-quicktime-plugin-replacement.html
object-src-none-blocks-youtube-plugin-replacement-expected.txt
object-src-none-blocks-youtube-plugin-replacement.html
plugins-types-allows-quicktime-plugin-replacement-expected.txt
plugins-types-allows-quicktime-plugin-replacement.html
plugins-types-allows-youtube-plugin-replacement-expected.txt
plugins-types-allows-youtube-plugin-replacement.html
plugins-types-blocks-quicktime-plugin-replacement-expected.txt
plugins-types-blocks-quicktime-plugin-replacement-without-mime-type-expected.txt
plugins-types-blocks-quicktime-plugin-replacement-without-mime-type.html
plugins-types-blocks-quicktime-plugin-replacement.html
plugins-types-blocks-youtube-plugin-replacement-expected.txt
plugins-types-blocks-youtube-plugin-replacement-without-mime-type-expected.txt
plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html
plugins-types-blocks-youtube-plugin-replacement.html
script-with-file-url-allowed-by-script-src-star-expected.txt CSP: Content Security Policy should allow '*' to match the originating page's scheme 2016-06-17 03:51:00 +00:00
script-with-file-url-allowed-by-script-src-star.html
video-with-blob-url-allowed-by-media-src-star-expected.html
video-with-blob-url-allowed-by-media-src-star.html
video-with-data-url-allowed-by-media-src-star-expected.html
video-with-data-url-allowed-by-media-src-star.html
video-with-file-url-allowed-by-media-src-star-expected.html
video-with-file-url-allowed-by-media-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html
video-with-file-url-allowed-by-media-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html
video-with-file-url-allowed-by-media-src-star.html
worker-inherits-blocks-eval-expected.txt
worker-inherits-blocks-eval.html
worker-inherits-blocks-xhr-expected.txt
worker-inherits-blocks-xhr.html