Media documents should not block initial media request by CSP
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 9.4k
- Forks
- 3.2k
- PR merge metrics
- PR metrics pending
Description
What is the issue with the HTML Standard?
https://html.spec.whatwg.org/multipage/document-lifecycle.html#navigate-media invokes https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object which sets the policy container from navigationParams in https://html.spec.whatwg.org/multipage/document-lifecycle.html#shared-document-creation-infrastructure:concept-document-policy-container
However, all browsers do not set the CSP header for image documents: https://wpt.fyi/results/content-security-policy/generic/image-document-ignores-csp.html?label=master&label=experimental&product=chrome&product=edge&product=firefox&product=safari&product=servo&aligned Servo ran into this and added a test. Now I am implementing document loading infrastructure in Servo and discovered that this step was missing in our code compared to the specification.
Probably the specification needs updating to set navigationParams.policycontainer to null?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the media navigation and shared document creation sections linked in the issue with the WPT image-document-ignores-csp test and the browser results. Trace how navigationParams.policycontainer is handled for image documents, then determine the specification change needed to match the observed behavior and Servo's test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- documentation
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100