Remove the 'reflected-xss' directive from CSP.

Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

Intent to Remove: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/gjB93RpF6JY

R=jochen@chromium.org
BUG=657737
Committed: https://crrev.com/1a6748ba9cfb1bb961e5f62580c30958bca5d55f
Cr-Commit-Position: refs/heads/master@{#427040}

[Mike West, 2016-10-18 13:37:01]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-18 13:37:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-18 14:48:54]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-18 14:48:54]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Mike West, 2016-10-18 19:24:13]

With the caveat that I need to rebaseline a few hundred layout tests to change a
console message, WDYT about removing the `reflected-xss` directive that no one
else is ever going to ship and that we've removed from spec documents entirely
(~1.5 years ago *cough*)?

https://chromiumcodereview.appspot.com/2428473004/diff/1/third_party/WebKit/S...
File third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.cpp (right):

https://chromiumcodereview.appspot.com/2428473004/diff/1/third_party/WebKit/S...
third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.cpp:61: " The
auditor was enabled as the server did not send an "
This means I need to rebaseline ~200 layout tests. *sigh*

[jochen (gone - plz use gerrit), 2016-10-19 14:25:40]

do you know how many ppl use this directive? Will a page break if it includes
this in its csp?

[Mike West, 2016-10-20 07:56:40]

On 2016/10/19 at 14:25:40, jochen wrote:
> do you know how many ppl use this directive?

No. My guess is that usage is minimal, as:

1. We've removed the directive from published CSP documents over a year ago
2. No other browser ships the directive.
3. Other browsers that support an XSS Auditor still require `X-XSS-Protection`.

> Will a page break if it includes this in its csp?

Due to #3 above, I suspect the impact will be minimal, as developers would
likely have kept the existing header in place for Safari and Edge.

In the worst case, a developer sent only `CSP: reflected-xss 'allow'` to disable
the filter and didn't send a corresponding `X-XSS-Protection` header, the filter
would be enabled. This risk will be minimized by changing the default option for
the XSS Auditor to "block" in the near future.

I think this is pretty low risk, but if you'd prefer this go to the wider group
of folks on blink-dev@, I'm happy to do so.

[Mike West, 2016-10-20 13:07:10]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-20 13:07:30]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2016-10-20 13:09:56]

On 2016/10/20 at 07:56:40, Mike West wrote:
> On 2016/10/19 at 14:25:40, jochen wrote:
> > do you know how many ppl use this directive?
> 
> No. My guess is that usage is minimal, as:
> 
> 1. We've removed the directive from published CSP documents over a year ago
> 2. No other browser ships the directive.
> 3. Other browsers that support an XSS Auditor still require
`X-XSS-Protection`.
> 
> > Will a page break if it includes this in its csp?
> 
> Due to #3 above, I suspect the impact will be minimal, as developers would
likely have kept the existing header in place for Safari and Edge.
> 
> In the worst case, a developer sent only `CSP: reflected-xss 'allow'` to
disable the filter and didn't send a corresponding `X-XSS-Protection` header,
the filter would be enabled. This risk will be minimized by changing the default
option for the XSS Auditor to "block" in the near future.
> 
> I think this is pretty low risk, but if you'd prefer this go to the wider
group of folks on blink-dev@, I'm happy to do so.

Added in one-line changes to a million layout tests.

WDYT?

[Mike West, 2016-10-20 13:11:09]

Description was changed from

==========
Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

R=jochen@chromium.org
==========

to

==========
Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

Intent to Remove:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/gjB93RpF6JY

R=jochen@chromium.org
BUG=657737
==========

[commit-bot: I haz the power, 2016-10-20 14:31:21]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-20 14:31:22]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[jochen (gone - plz use gerrit), 2016-10-21 11:00:45]

lgtm

[Mike West, 2016-10-24 07:04:42]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2016-10-24 07:04:42]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/2428473004/#ps40001
(title: "Test.")

[commit-bot: I haz the power, 2016-10-24 07:04:51]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-24 09:00:27]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-24 09:00:28]

Try jobs failed on following builders:
  android_clang_dbg_recipe on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/android_clan...)

[Mike West, 2016-10-24 09:17:28]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2016-10-24 09:17:46]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-24 11:06:24]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-10-24 11:08:46]

Description was changed from

==========
Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

Intent to Remove:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/gjB93RpF6JY

R=jochen@chromium.org
BUG=657737
==========

to

==========
Remove the 'reflected-xss' directive from CSP.

This was removed from CSP2, never added to CSP3, and will not ship in
any other browser. We should remove it, as it is completely redundant
with `X-XSS-Protection`, which is never going away.

Intent to Remove:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/gjB93RpF6JY

R=jochen@chromium.org
BUG=657737

Committed: https://crrev.com/1a6748ba9cfb1bb961e5f62580c30958bca5d55f
Cr-Commit-Position: refs/heads/master@{#427040}
==========

[commit-bot: I haz the power, 2016-10-24 11:08:48]

Patchset 3 (id:??) landed as
https://crrev.com/1a6748ba9cfb1bb961e5f62580c30958bca5d55f
Cr-Commit-Position: refs/heads/master@{#427040}