as requested by aaj@
We'll also need to wire https://w3c.github.io/webappsec-csp/#can-compile-strings up to the reporting infrastructure, which is missing completely at the moment. Would you like to do that, Jochen, or shall I?
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/322b2d7d14cdf1d6d53fb763e14b9b058f29a020 commit 322b2d7d14cdf1d6d53fb763e14b9b058f29a020 Author: Jochen Eisinger <jochen@chromium.org> Date: Tue Jun 13 13:39:27 2017 Pass the string we're about to compile to embedder This gives the embedder more context for deciding whether code generation should be allowed or not, or they can chose to include the code in a report. BUG= chromium:732736 R=ahaas@chromium.org Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ibbaa3d0574319d290f15565be3eed2ee4d3dda36 Reviewed-on: https://chromium-review.googlesource.com/532875 Commit-Queue: Jochen Eisinger <jochen@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#45905} [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/include/v8.h [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/api.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/compiler.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/compiler.h [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/runtime/runtime-compiler.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/runtime/runtime-test.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/src/wasm/wasm-module.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/test/cctest/test-api.cc [modify] https://crrev.com/322b2d7d14cdf1d6d53fb763e14b9b058f29a020/test/cctest/wasm/test-run-wasm-module.cc
nah, I'll just do the plumbing
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9dae37de837ad9279b7b89f8c523485645c3ba40 commit 9dae37de837ad9279b7b89f8c523485645c3ba40 Author: Jochen Eisinger <jochen@chromium.org> Date: Wed Jun 21 10:43:56 2017 Plumb source we're about to eval to CSP BUG= 732736 R=mkwst@chromium.org Change-Id: I1d151eb2b1e1f61749d1a67ee4bd18961b70738c Reviewed-on: https://chromium-review.googlesource.com/532915 Commit-Queue: Jochen Eisinger <jochen@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/master@{#481168} [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample.html [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp [modify] https://crrev.com/9dae37de837ad9279b7b89f8c523485645c3ba40/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
Your turn :)
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/54225d6563556bbfb1b4b7df5e59732026a52a0b commit 54225d6563556bbfb1b4b7df5e59732026a52a0b Author: Mike West <mkwst@chromium.org> Date: Wed Jun 21 22:53:00 2017 Send 'script-sample' for 'unsafe-eval' violations. We ought to be sending script samples for 'unsafe-eval' violations, as well as inline script/style blocks. This patch enables the mechanism defined in https://w3c.github.io/webappsec-csp/#can-compile-strings, and updates upstreamed tests accordingly. Intent to Ship: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/XlcpobBfJOI/8WYpiyk0CQAJ Bug: 732736 Change-Id: I10d8331dadc327356e8dc568bfe3374b5886bba5 Reviewed-on: https://chromium-review.googlesource.com/543240 Reviewed-by: Jochen Eisinger <jochen@chromium.org> Commit-Queue: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/master@{#481341} [modify] https://crrev.com/54225d6563556bbfb1b4b7df5e59732026a52a0b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html [modify] https://crrev.com/54225d6563556bbfb1b4b7df5e59732026a52a0b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample.html [modify] https://crrev.com/54225d6563556bbfb1b4b7df5e59732026a52a0b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp [modify] https://crrev.com/54225d6563556bbfb1b4b7df5e59732026a52a0b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h
Updated the spec and landed the change.
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/417123dd4f43c13bb8e6f6f763cfe809b65a7913 commit 417123dd4f43c13bb8e6f6f763cfe809b65a7913 Author: Jochen Eisinger <jochen@chromium.org> Date: Thu Jun 22 07:25:08 2017 Deprecate old-style allow code-gen callback BUG= chromium:732736 R=marja@chromium.org Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I3b3dfdd0c55a7ec267ae26765901497611d39d29 Reviewed-on: https://chromium-review.googlesource.com/543158 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Jochen Eisinger <jochen@chromium.org> Cr-Commit-Position: refs/heads/master@{#46112} [modify] https://crrev.com/417123dd4f43c13bb8e6f6f763cfe809b65a7913/include/v8.h
Woohoo, awesome!! Thank you Jochen & Mike!
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/749b9c062ea20eaf4fa5701b2c0da67d3c2d939b commit 749b9c062ea20eaf4fa5701b2c0da67d3c2d939b Author: Jochen Eisinger <jochen@chromium.org> Date: Tue Aug 22 13:42:56 2017 Remove deprecated allow code-gen callback BUG= chromium:732736 R=marja@chromium.org Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I2c0a96b76ae977e53a418d22175bcc487f548786 Reviewed-on: https://chromium-review.googlesource.com/543238 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Jochen Eisinger <jochen@chromium.org> Cr-Commit-Position: refs/heads/master@{#47509} [modify] https://crrev.com/749b9c062ea20eaf4fa5701b2c0da67d3c2d939b/include/v8.h [modify] https://crrev.com/749b9c062ea20eaf4fa5701b2c0da67d3c2d939b/src/api.cc
Comment 1 by mkwst@chromium.org
, Jun 13 2017