PlzNavigate: "form-action" checks should be fully disabled on the renderer-side. |
||
Issue descriptionWhen "form-action" checks will be implemented on the browser-side with: https://crrev.com/2689653003/ It will be necessary to fully disable the renderer-side checks. The current behavior with PlzNavigate is: * The "form-action" of the frame that has initiated the form submission is enforced on the renderer side when the form is submitted. * The "form-action" of the frame that is navigating is enforced on the browser-side for the initial url and all of its redirects. The current behavior without PlzNavigate is the same but it always happens on the renderer-side. We want: 1) To enforce the "form-action" CSP on the browser-side only, except when it doesn't trigger a navigation. 2) To use the CSP of the frame that has initiated the navigation and not the CSP of the one that is navigating(See https://crbug.com/700964)
,
Dec 1 2017
While working on refactoring the browser-side CSP checks in https://crbug.com/713388, and trying to disable the renderer-side checks, I ran into a couple issues that may be relevant to this: 1) Javascript form actions never trigger a navigation, and so are un-enforceable browser side. We'll need at least some amount of renderer-side form-action CSP checking to handle this. 2) The "form-action-blocked-when-target-blank.html" and "form-action-blocked-when-target-cross-site-window.html" time out. I may end up debugging this (which I think is related to (2) above) as party of my CL.
,
Feb 18 2018
|
||
►
Sign in to add a comment |
||
Comment 1 by est...@chromium.org
, Nov 10 2017