Visitar URL original
Remove deprecated plugin-types CSP directive by Copilot · Pull Request #569 · github/secure_headers · GitHub
Skip to content

Remove deprecated plugin-types CSP directive - #569

Draft
fletchto99 with Copilot wants to merge 4 commits into
mainfrom
copilot/fix-plugin-types-validation
Draft

Remove deprecated plugin-types CSP directive#569
fletchto99 with Copilot wants to merge 4 commits into
mainfrom
copilot/fix-plugin-types-validation

Conversation

Copilot AI commented Dec 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

The plugin-types directive was removed from the CSP specification and browser support was dropped years ago. This removes it from secure_headers.

Changes:

  • Removed PLUGIN_TYPES constant and directive from DIRECTIVES_2_0
  • Removed :media_type_list validation type and validate_media_type_expression! method
  • Removed plugin_types from README configuration example
  • Removed validation tests for plugin-types

Migration:
Configurations using plugin_types will now raise ContentSecurityPolicyConfigError for unknown directive. Remove the directive from your CSP configuration:

# Before
config.csp = {
  default_src: %w('self'),
  plugin_types: %w(application/pdf),  # Remove this line
  script_src: %w('self')
}

# After
config.csp = {
  default_src: %w('self'),
  script_src: %w('self')
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • coveralls.io
    • Triggering command: /usr/bin/ruby3.2 ruby3.2 /home/REDACTED/work/secure_headers/secure_headers/vendor/bundle/ruby/3.2.0/bin/rspec spec/lib/secure_headers/headers/policy_management_spec.rb /tmp/cc7d9JqQ.s conf�� by-3.2.0 --global ism-1.6.0/include user.email ism-1.6.0/ext (dns block)
    • Triggering command: /usr/bin/ruby3.2 ruby3.2 /home/REDACTED/work/secure_headers/secure_headers/vendor/bundle/ruby/3.2.0/bin/rspec token_type.o /tmp/ccdmjqra.s vend�� in.so /lto-wrapper /home/REDACTED/.ca-I kward (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

This section details on the original issue you should resolve

<issue_title>Validation on plugin-types does not allow for the empty directive</issue_title>
<issue_description># Bugs

Note: The plugin-types grammar allows for an empty directive value in which case all instantions of embed and object will fail.

https://w3c.github.io/webappsec-csp/#directive-plugin-types

We validate it must match something like application/pdf which is not correct.

Expected outcome

Describe what you expected to happen

plugin_types should allow for an empty directive. Sending an empty array omits the directive. Sending none is not allowed by validation. An array of empty strings doesn't work either (validation)

Actual outcome

Configuration errors when trying to do the right thing

</issue_description>

<agent_instructions>Based on this comment (#448 (comment))

It looks like the plugin-type directive was removed. Can you remove the plugin-type directive and associated tests?</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@fletchto99 It looks like the `plugin-type` directive was removed. Perhaps instead we should remove it from secure_headers? From what I can tell only webkit and chrome supported it and removed support a few years ago.

cc https://issues.chromium.org/issues/40164809
cc w3c/webappsec-csp#456</comment_new>

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@fletchto99
Initial progress: Planning removal of plugin-types directive
1714721 
Co-authored-by: fletchto99 <718681+fletchto99@users.noreply.github.com>
github-advanced-security[bot]
github-advanced-security AI found potential problems Dec 17, 2025
View reviewed changes
Comment thread ...r/bundle/ruby/3.2.0/gems/rubocop-1.82.0/lib/rubocop/cop/layout/space_inside_range_literal.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/rake-13.3.1/lib/rake/application.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/pry-0.14.2/lib/pry/helpers/text.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/parser-3.3.10.0/lib/parser/source/buffer.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/notiffany-0.1.3/lib/notiffany/notifier/emacs.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/benchmark-ips-2.14.0/lib/benchmark/ips/job.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/benchmark-ips-2.14.0/lib/benchmark/ips/job.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/activesupport-8.1.1/lib/active_support/file_update_checker.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/activesupport-8.1.1/lib/active_support/encrypted_file.rb Fixed
Comment thread vendor/bundle/ruby/3.2.0/gems/ffi-1.17.2-x86_64-linux-gnu/lib/ffi/tools/types_generator.rb Fixed
@fletchto99
Remove deprecated plugin-types directive
7921de2 
Co-authored-by: fletchto99 <718681+fletchto99@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix validation for empty plugin-types directive Remove deprecated plugin-types CSP directive Dec 17, 2025
Copilot AI requested a review from fletchto99 December 17, 2025 19:16

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fletchto99 fletchto99 Awaiting requested review from fletchto99
Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review

At least 1 approving review is required to merge this pull request.

Assignees

@fletchto99 fletchto99

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Validation on plugin-types does not allow for the empty directive

4 participants

@github-advanced-security @fletchto99 @boveus