Sketching `[InjectionMitigated]`. WIP, DNC, etc. [chromium/src : main]
Mike West (Gerrit)
Mike West added 1 comment![]( "Open in Gerrit")
Hey Simon! If I clean this up and get it past our friendly bindings team (and update all the tests), would you accept it as a replacement for the check we agreed upon in https://chromium-review.googlesource.com/c/chromium/src/+/5287414?
TL;DR: Same model as `SecureContext`: skip runtime checks by limiting the API's exposure in the first place.
Related details
Code-Coverage
Code-Review
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Mike West (Gerrit)
Mike West added 1 comment![]( "Open in Gerrit")
Ugh. Actually adding you, Simon. 😊
Copy/pasting from the comment I didn't send you: Hey Simon! If I clean this up and get it past our friendly bindings team (and update all the tests), would you accept it as a replacement for the check we agreed upon in https://chromium-review.googlesource.com/c/chromium/src/+/5287414?
TL;DR: Same model as `SecureContext`: skip runtime checks by limiting the API's exposure in the first place.
Code-Coverage
Code-Review
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Simon Hangl (Gerrit)
Simon Hangl voted and added 4 comments![]( "Open in Gerrit")
Votes added by Simon Hangl
| Code-Review | +1 |
4 comments
Ugh. Actually adding you, Simon. 😊
Copy/pasting from the comment I didn't send you: Hey Simon! If I clean this up and get it past our friendly bindings team (and update all the tests), would you accept it as a replacement for the check we agreed upon in https://chromium-review.googlesource.com/c/chromium/src/+/5287414?
TL;DR: Same model as `SecureContext`: skip runtime checks by limiting the API's exposure in the first place.
If I understand this right, the only difference would be that the API doesn't even show up in non-strict-csp-contexts (instead of the current runtime check)? Are there any other differences?
If not, I think this is cool, thanks.
LGTM % nits
return GetContentSecurityPolicy()->IsStrictPolicyEnforced();Do we also want to check `RequiresTrustedTypes` here? If not, I'd suggest to name the idl attribute something along the lines of `StrictCsp`.
MeasureAs = GetAllScreensMedia, InjectionMitigatedBased on my conversations with the security folks, I'd be hesitant naming this `InjectionMitigated`. To my understanding CSP (and trusted types?) is mostly a mitigation for client side xss attacks.
@a...@google.com do you have an opinion on this?
Related details
- Artur Janc
- Mike West
Code-Coverage
Code-Review
No-Unresolved-Comments
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Artur Janc (Gerrit)
Artur Janc added 1 comment![]( "Open in Gerrit")
MeasureAs = GetAllScreensMedia, InjectionMitigatedBased on my conversations with the security folks, I'd be hesitant naming this `InjectionMitigated`. To my understanding CSP (and trusted types?) is mostly a mitigation for client side xss attacks.
@a...@google.com do you have an opinion on this?
I'd be fine with `InjectionMitigated` - XSS almost always depends on an injection of HTML into a page, and CSP (and Trusted Types) is meant to mitigate the impact of such injections (i.e. not allow them to lead to script execution on the page). So the name makes sense to me.
Related details
- Mike West
- Simon Hangl
Code-Coverage
Code-Review
No-Unresolved-Comments
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Simon Hangl (Gerrit)
Simon Hangl added 1 comment![]( "Open in Gerrit")
return GetContentSecurityPolicy()->IsStrictPolicyEnforced();One further remark: we will need to support `getAllScreensMedia` in CSP and isolated web apps for some time (to enable developers to pivot to IWAs) and I think the strict CSP we check here does not 1to1 match the [IWA CSP](https://github.com/WICG/isolated-web-apps).
This makes me wonder if this function should also return true if we are in an isolated context:
```
const auto* csp = GetContentSecurityPolicy();
return (csp->IsStrictPolicyEnforced() && csp->RequiresTrustedTypes) || IsIsolatedContext();
```
Related details
- Mike West
Code-Coverage
Code-Review
No-Unresolved-Comments
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Blink W3C Test Autoroller (Gerrit)
Message from Blink W3C Test Autoroller![]( "Open in Gerrit")
Exportable changes to web-platform-tests were detected in this CL and a pull request in the upstream repo has been made: https://github.com/web-platform-tests/wpt/pull/45902.
When this CL lands, the bot will automatically merge the PR on GitHub if the required GitHub checks pass; otherwise, ecosystem-infra@ team will triage the failures and may contact you.
WPT Export docs:
https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md#Automatic-export-process
Related details
- Mike West
- Simon Hangl
Code-Coverage
Code-Review
No-Unresolved-Comments
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |