Bug 264355 - Content Security Policy for previous load should not apply to subsequent alternate HTML load
Summary: Content Security Policy for previous load should not apply to subsequent alte...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: PC Linux
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-11-07 12:08 PST by Michael Catanzaro
Modified: 2024-04-12 09:18 PDT (History)
7 users (show)

See Also:


Attachments
expected result (37.98 KB, image/png)
2023-11-07 12:08 PST, Michael Catanzaro
no flags Details
actual result (35.76 KB, image/png)
2023-11-07 12:09 PST, Michael Catanzaro
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Catanzaro 2023-11-07 12:08:13 PST
Created attachment 468507 [details]
expected result

To reproduce, first load https://duckduckgo.com/ and then load https://expired.badssl.com/

In Epiphany, the expected result is for an insecure lock icon to be displayed on the TLS error page. But actually, the icon is blocked by DuckDuckGo's Content Security Policy, i.e. the CSP for the *previous* page is still being enforced for the next load, even though the next load is for a different website that has nothing to do with DuckDuckGo. This is probably specific to alternate HTML loads, but I'm not certain.

The TLS error page works fine if I visit https://expired.badssl.com/ directly without first loading https://duckduckgo.com/

(I assume it won't be possible to reproduce the exact same error in Safari as the TLS error page is surely constructed differently, but it seems unlikely that the underlying bug is platform-specific.)
Comment 1 Michael Catanzaro 2023-11-07 12:09:19 PST
Created attachment 468508 [details]
actual result

Almost forgot to provide the error message from the web inspector:

[Error] Refused to load ephy-resource:///org/gnome/epiphany/page-icons/channel-insecure-symbolic.svg because it does not appear in the img-src directive of the Content Security Policy.
Comment 2 Patrick Griffis 2023-11-07 12:26:51 PST
Note that the error page isn't a normal navigation, its `WebPage::loadAlternateHTML()`, possibly leaving some state behind.
Comment 3 Radar WebKit Bug Importer 2023-11-14 12:09:14 PST
<rdar://problem/118411558>