Repository navigation
connect-src tests allow two non-interopable implementations to both pass #50387
Description
For context see:
CSP issue: w3c/webappsec-csp#120
Chromium Issue: https://issues.chromium.org/issues/41278387
WebKit issue: https://bugs.webkit.org/show_bug.cgi?id=286744
Firefox issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1951698
connect-src should no longer throw a SecurityError in the EventSource constructor for example, however, the WPTs allow it to happen (see https://github.com/web-platform-tests/wpt/blob/master/content-security-policy/connect-src/connect-src-eventsource-blocked.sub.html)
These tests should be updated to match the spec (and majority of implementations), so WebKit correctly fails them.
cc @mikewest
Activity
lukewarlow commentedon Jan 30, 2025
Another example of a mismatch is /content-security-policy/connect-src/connect-src-syncxmlhttprequest-blocked.sub.html which allows .send to throw or trigger an error event on the XHR object. In that case all 3 engines throw an exception so XHR.onerror shouldn't allow a test pass.
annevk commentedon Feb 28, 2025
Are you willing to fix these tests? (I had to read the XMLHttpRequest case twice, but it makes sense that for synchronous XMLHttpRequest you would not get an event from the "network" layer.)