From 6e03ebc94d37563b474c9fc99fb3fa191a1c06c4 Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Thu, 13 Feb 2025 07:21:40 -0800 Subject: [PATCH] require-sri-for: 'script' `require-sri-for` would enable documents to enforce SRI on all resources they load (of a certain type). This CL revives a previous attempt [1] at this that ended up being removed. It only adds the 'script' part of it, as this has a clear use case [2]. Intent-to-Prototype: https://groups.google.com/a/chromium.org/g/blink-dev/c/CdLp5BM2FCQ/m/t9ae0Do_AAAJ Spec PR: https://github.com/w3c/webappsec-subresource-integrity/pull/129 [1] https://chromium-review.googlesource.com/c/chromium/src/+/2199260 [2] https://docs.google.com/document/d/1RcUpbpWPxXTyW0Qwczs9GCTLPD3-LcbbhL4ooBUevTM/edit?tab=t.0 Change-Id: I66acc12b073174cb33cf594b714e803e24656d27 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5877633 Reviewed-by: Antonio Sartori Commit-Queue: Yoav Weiss (@Shopify) Reviewed-by: Arthur Sonzogni Cr-Commit-Position: refs/heads/main@{#1419883} --- common/dispatcher/remote-executor.html | 5 +- content-security-policy/resources/ran.js | 1 + .../script-allowed-meta.https.html | 14 ++ .../script-blocked-meta.https.html | 13 ++ .../require-sri-for/script.https.html | 148 ++++++++++++++++++ 5 files changed, 180 insertions(+), 1 deletion(-) create mode 100644 content-security-policy/resources/ran.js create mode 100644 content-security-policy/tentative/require-sri-for/script-allowed-meta.https.html create mode 100644 content-security-policy/tentative/require-sri-for/script-blocked-meta.https.html create mode 100644 content-security-policy/tentative/require-sri-for/script.https.html diff --git a/common/dispatcher/remote-executor.html b/common/dispatcher/remote-executor.html index 8b0030390d0d19..f87f566be960fd 100644 --- a/common/dispatcher/remote-executor.html +++ b/common/dispatcher/remote-executor.html @@ -3,7 +3,10 @@ - + + + + + + diff --git a/content-security-policy/tentative/require-sri-for/script-blocked-meta.https.html b/content-security-policy/tentative/require-sri-for/script-blocked-meta.https.html new file mode 100644 index 00000000000000..fe69c61f5b6c68 --- /dev/null +++ b/content-security-policy/tentative/require-sri-for/script-blocked-meta.https.html @@ -0,0 +1,13 @@ + + + + + + diff --git a/content-security-policy/tentative/require-sri-for/script.https.html b/content-security-policy/tentative/require-sri-for/script.https.html new file mode 100644 index 00000000000000..4c75e14de9c962 --- /dev/null +++ b/content-security-policy/tentative/require-sri-for/script.https.html @@ -0,0 +1,148 @@ + + + + + + + + +