[Webkit-unassigned] [Bug 272745] New: VT (0x0b) stripped from XFO/CSP even though only HTTP-/ascii-whitespace should be stripped

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=272745

            Bug ID: 272745
           Summary: VT (0x0b) stripped from XFO/CSP even though only
                    HTTP-/ascii-whitespace should be stripped
           Product: WebKit
           Version: Safari 17
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jannis.rautenstrauch at cispa.de

Vertical Tabs (0x0b) are interpreted as whitespace for both XFO and CSP even though the specification require ascii-whitespace [CSP](https://w3c.github.io/webappsec-csp/#framework-infrastructure) or HTTP whitespace [XFO](https://fetch.spec.whatwg.org/#http-whitespace) that both do not contain VT.

- Example 1: `CSP: \vframe-ancestors 'none'` [URL](http://sub.headers.websec.saarland/_hp/tests/framing.sub.html?resp_type=parsing&browser_id=1&label=CSP-FA&first_id=6265&last_id=6269&scheme=http&t_resp_id=6269&t_element_relation=iframe_direct&t_resp_origin=https://headers.webappsec.eu)
- Example 2: `CSP: img-src\v 'self'`[URL](http://sub.headers.websec.saarland/_hp/tests/subresource-loading-csp.sub.html?resp_type=parsing&browser_id=1&label=CSP-IMG&first_id=29354&last_id=29358&scheme=http&t_resp_id=29354&t_element_relation=iframe_direct&t_resp_origin=https://headers.webappsec.eu)
- Example 3: `XFO: DENY\v`[URL](http://sub.headers.websec.saarland/_hp/tests/framing.sub.html?resp_type=parsing&browser_id=1&label=XFO&first_id=3630&last_id=3634&scheme=http&t_resp_id=3633&t_element_relation=iframe_direct&t_resp_origin=https://headers.webappsec.eu)

Chromium has the same issue. Firefox does not strip \v and interprets all these examples as invalid.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240416/87b90360/attachment.htm>