[Webkit-unassigned] [Bug 68921] New: CSP doesn't work for a wide variety of cases

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68921

           Summary: CSP doesn't work for a wide variety of cases
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
               URL: http://erlend.oftedal.no/blog/csp/readiness/latest.php
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: smus at google.com
                CC: abarth at webkit.org


In my own tests, as well as in more comprehensive test suites, CSP policy is not being followed as expected. 

This test suite: http://erlend.oftedal.no/blog/csp/readiness/latest.php provides both X-Content-Security-Policy and X-WebKit-CSP headers, and uses the new syntax ('default-src' rather than 'allow'), but fails for most test cases.

Do we have a CSP unit test suite?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.