Bug 255651 - Add support for the CSP "webrtc" CSP
Summary: Add support for the CSP "webrtc" CSP
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-04-19 04:29 PDT by Robin Berjon
Modified: 2023-07-05 07:28 PDT (History)
10 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robin Berjon 2023-04-19 04:29:12 PDT 
The latest CSP has a `webrtc` directive to control whether WebRTC connections can be established (https://w3c.github.io/webappsec-csp/#directive-webrtc).

Supporting this is useful in order to be able to make stronger guarantees that data cannot be exfiltrated.
Comment 1 Radar WebKit Bug Importer 2023-04-26 04:30:21 PDT 
<rdar://problem/108551702>
Comment 2 Ian Preston 2023-06-15 02:33:35 PDT 
We need this in Peergos to run untrusted web apps over private data without the possibility of the app stealing the data. 

We describe the use case more and link other browser issues here: https://github.com/Peergos/Peergos/issues/1044
Comment 3 youenn fablet 2023-06-15 02:39:34 PDT 
Implementation strategy is probably to add some checks at RTCSocketFactory level (created for each peer connection) so that we disable:
- any socket traffic
- any name resolution