Ladybird/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-06-08 05:27:14 +09:00
Code Activity

LibWeb/HTML: Set a fetch client for javascript URL navigations

Browse source 
There is an open spec issue for this, and I'm certainly not sure
what the client should be here, but using the source snapshot
from the global from reading the spec issue seems like a reasonable
enough client for now.

This can be reproduced by performing a javascript URL navigation
with any CSP policy set. For simplicity, simply edit an existing
testcase to add such a policy.

Fixes: #4853
This commit is contained in:
Shannon Booth 2025-05-23 22:39:16 +12:00 • committed by Jelle Raaijmakers
parent e364443e60
commit cdb249e058
Notes: github-actions[bot] 2025-05-23 14:40:16 +00:00
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Libraries/LibWeb/HTML/Navigable.cpp
View file

@ -1931,6 +1931,9 @@ void Navigable::navigate_to_a_javascript_url(URL::URL const& url, HistoryHandlin
request->set_url(url);
request->set_policy_container(source_snapshot_params->source_policy_container);
// AD-HOC: See https://github.com/whatwg/html/issues/4651, requires some investigation to figure out what we should be setting here.
request->set_client(source_snapshot_params->fetch_client);
// 5. If the result of should navigation request of type be blocked by Content Security Policy? given request and cspNavigationType is "Blocked", then return.
if (ContentSecurityPolicy::should_navigation_request_of_type_be_blocked_by_content_security_policy(request, csp_navigation_type) == ContentSecurityPolicy::Directives::Directive::Result::Blocked)
return;

3
Tests/LibWeb/Text/input/navigation/iframe-navigate-javascript-url.html
View file

@ -1,4 +1,7 @@
<!DOCTYPE html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src javascript:;">
</head>
<script src="../include.js"></script>
<script>
asyncTest((done) => {