Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 150a3a12e5801be315f86481589b750a41fd7e57
https://github.com/WebKit/WebKit/commit/150a3a12e5801be315f86481589b750a41fd7e57
Author: Roberto Rodriguez <[email protected]>
Date: 2026-06-18 (Thu, 18 Jun 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-json-import-allowed.sub-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-json-import-blocked.sub-expected.txt
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
Log Message:
-----------
CSP applies script-src to JSON module imports instead of connect-src
https://bugs.webkit.org/show_bug.cgi?id=317377
rdar://180006320
Reviewed by Anne van Kesteren.
JSON module imports should be controlled by connect-src but are currently
controlled
by script-src. Fix by enforcing connect-src for JSON module imports.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-json-import-allowed.sub-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-json-import-blocked.sub-expected.txt:
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
Canonical link: https://commits.webkit.org/315497@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
