Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(285)

Issue 1861253004: Check CSP before registering ServiceWorkers (Closed)

Created:
4 years, 8 months ago by estark
Modified:
4 years, 8 months ago
Reviewers:
falken, Mike West
CC:
chromium-reviews, michaeln, mkwst+watchlist-csp_chromium.org, tzik, serviceworker-reviews, jsbell+serviceworker_chromium.org, nhiroki, falken, haraken, kinuko+serviceworker, blink-reviews, horo+watch_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Check CSP before registering ServiceWorkers Service Worker registrations should be subject to the same CSP checks as other workers. The spec doesn't say this explicitly (https://www.w3.org/TR/CSP2/#directive-child-src-workers says "Worker or SharedWorker constructors"), but it seems to be in the spirit of things, and it matches Firefox's behavior. BUG=579801 Committed: https://crrev.com/5289a5d4c98681e9a0f2d28da0c7aa35e282db57 Cr-Commit-Position: refs/heads/master@{#385775}

Patch Set 1 #

Messages

Total messages: 12 (3 generated)
estark
falken, mkwst, PTAL?
4 years, 8 months ago (2016-04-06 21:52:29 UTC) #2
Marijn Kruisselbrink
I wonder how this would/should work for service workers installed via a Link: rel=serviceworker http ...
4 years, 8 months ago (2016-04-06 22:01:50 UTC) #3
estark
On 2016/04/06 22:01:50, Marijn Kruisselbrink wrote: > I wonder how this would/should work for service ...
4 years, 8 months ago (2016-04-06 23:13:11 UTC) #4
falken
lgtm with question Should we also check CSP on importScripts() in the service worker script? ...
4 years, 8 months ago (2016-04-07 05:06:08 UTC) #5
Mike West
On 2016/04/07 at 05:06:08, falken wrote: > lgtm with question LGTM. I think we'll probably ...
4 years, 8 months ago (2016-04-07 08:42:32 UTC) #6
estark
Thanks both. On 2016/04/07 08:42:32, Mike West wrote: > On 2016/04/07 at 05:06:08, falken wrote: ...
4 years, 8 months ago (2016-04-07 15:28:40 UTC) #7
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1861253004/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1861253004/1
4 years, 8 months ago (2016-04-07 15:29:22 UTC) #9
commit-bot: I haz the power
Committed patchset #1 (id:1)
4 years, 8 months ago (2016-04-07 16:14:53 UTC) #10
commit-bot: I haz the power
4 years, 8 months ago (2016-04-07 16:16:54 UTC) #12
Message was sent while issue was closed.
Patchset 1 (id:??) landed as
https://crrev.com/5289a5d4c98681e9a0f2d28da0c7aa35e282db57
Cr-Commit-Position: refs/heads/master@{#385775}

Powered by Google App Engine
This is Rietveld 408576698