[Webkit-unassigned] [Bug 153160] New: CSP: Don't inherit parent's CSP in PluginDocuments
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Jan 15 15:12:39 PST 2016
https://bugs.webkit.org/show_bug.cgi?id=153160
Bug ID: 153160
Summary: CSP: Don't inherit parent's CSP in PluginDocuments
Classification: Unclassified
Product: WebKit
Version: WebKit Local Build
Hardware: All
OS: All
Status: NEW
Keywords: BlinkMergeCandidate
Severity: Normal
Priority: P2
Component: WebCore Misc.
Assignee: webkit-unassigned at lists.webkit.org
Reporter: dbates at webkit.org
We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=191037>.
Don't inherit parent's CSP in PluginDocuments
Inheriting the CSP in a PluginDocument causes <iframe src="foo.pdf"> to
be blocked if the parent's CSP forbids <embed src="foo.pdf">, as the
iframe turns into a PluginDocument with an <embed> tag inside it.
The only exception is that the plugin-types directive is still inherited from a parent document to a child PluginDocument, which preserves the current behavior and is required by the CSP spec.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160115/dc83f064/attachment.html>
More information about the webkit-unassigned
mailing list