Bug 1809683 [wpt PR 37881] - Remove `prefetch-src` and use least-restrictive directiv...
commit422c3230904eefc5ebb0a03bb41d8f58072ecbba
authorNoam Rosenthal <nrosenthal@chromium.org>
Tue, 21 Feb 2023 10:42:22 +0000 (21 10:42 +0000)
committermoz-wptsync-bot <wptsync@mozilla.com>
Tue, 28 Feb 2023 05:39:51 +0000 (28 05:39 +0000)
tree562cffbf735cfc16ce6264ce777c23c33ca4d547
parent67c2b82de8b0a058bc6cb65ef14f761e56749f7d
Bug 1809683 [wpt PR 37881] - Remove `prefetch-src` and use least-restrictive directive instead, a=testonly

Automatic update from web-platform-tests
Remove `prefetch-src` and use least-restrictive directive instead

This implements the spec:
https://w3c.github.io/webappsec-csp/#does-resource-hint-violate-policy

- Remove prefetch-src and anything related
- When CSP-testing a prefetch request, test if default-src or any
  other directive allows for that source
- Remove use of 'prefetch-src' from nav-speculation
  (spec issue: https://github.com/WICG/nav-speculation/issues/235)
- Add multiple WPTs to cover this.

Note that prefetch-src was erroneously enabled by default in 2021.

Bug: 1406444
Change-Id: I46bb76edaf7b280443ab4c3d4f6470bc30509d51
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4154428
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1104223}

--

wpt-commits: 021d1b5eb068f8f9a0791f70660a314508160b02
wpt-pr: 37881
24 files changed:
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-allowed.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-blocked-by-default.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-blocked.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-allowed.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-allowed.html.headers [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html.headers [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-blocked.html [deleted file]
testing/web-platform/tests/content-security-policy/prefetch-src/prefetch-header-blocked.html.headers [deleted file]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-allowed-by-any-directive.sub.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-allowed-by-default.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-allowed-no-default.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-allowed-with-conflicting-permissive-policies.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-blocked-by-default-multiple-policies.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-blocked-by-default.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-generate-directives.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-ignores-prefetch-src.sub.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/resource-hints/prefetch-no-csp.html [new file with mode: 0644]
testing/web-platform/tests/content-security-policy/support/prefetch-helper.js
testing/web-platform/tests/content-security-policy/support/prefetch-with-csp.html [new file with mode: 0644]
testing/web-platform/tests/speculation-rules/prerender/csp-prefetch-src-allow.html [deleted file]
testing/web-platform/tests/speculation-rules/prerender/csp-prefetch-src-disallow.html [deleted file]
testing/web-platform/tests/speculation-rules/prerender/resources/csp-prefetch-src-allow.sub.html [deleted file]
testing/web-platform/tests/speculation-rules/prerender/resources/csp-prefetch-src-disallow.sub.html [deleted file]