ladybird/Libraries/LibWeb/ContentSecurityPolicy
Andreas Kling 37130e7300 LibWeb: Don't apply connect-src to top-level navigation
Top-level navigation requests use the document fetch destination. CSP's
effective directive algorithm does not list document as a handled fetch
request destination, but our fallback path treated it like an unknown
fetch destination and applied connect-src.

Return no effective fetch directive for document destinations. This lets
top-level navigation use the CSP navigation checks instead. Keep nested
navigation on the existing frame and iframe path, since HTML rewrites
such requests to the container local name when a navigable has a
container.

This makes https://reddit.com/ load instead of redirecting to a blocked
challenge reponse URL.
2026-04-27 10:30:57 +02:00
..
Directives LibWeb: Don't apply connect-src to top-level navigation 2026-04-27 10:30:57 +02:00
BlockingAlgorithms.cpp LibWeb: Make more use of Value::{as,as_if,is} in LibWeb 2026-02-28 10:24:37 -05:00
BlockingAlgorithms.h LibWeb: Enforce Integrity Policy on Fetch requests 2025-08-14 13:37:38 +01:00
Policy.cpp LibHTTP+LibWeb+RequestServer: Move Fetch's HTTP header infra to LibHTTP 2025-11-27 14:57:29 +01:00
Policy.h LibWeb: Store HTTP methods and headers as ByteString 2025-11-26 09:15:06 -05:00
PolicyList.cpp LibWeb: Remove ShadowRealm HTML integration 2026-04-05 13:57:58 +02:00
PolicyList.h LibWeb: Support Content-Security-Policy http-equiv state on meta element 2025-05-23 16:39:13 +02:00
SecurityPolicyViolationEvent.cpp LibWeb/Bindings: Emit one bindings header and cpp per IDL 2026-04-21 07:36:13 +02:00
SecurityPolicyViolationEvent.h LibWeb/Bindings: Emit one bindings header and cpp per IDL 2026-04-21 07:36:13 +02:00
SecurityPolicyViolationEvent.idl LibWeb+LibIDL: Remove support for #import directives during parsing 2026-04-24 20:08:29 +02:00
SerializedPolicy.cpp LibURL+LibWeb: Make URL::Origin default constructor private 2025-06-17 20:54:03 +02:00
SerializedPolicy.h LibWeb/CSP: Introduce the ability to create and report a violation 2025-03-19 00:55:14 +01:00
Violation.cpp LibWeb: Remove ShadowRealm HTML integration 2026-04-05 13:57:58 +02:00
Violation.h LibWeb/CSP: Introduce the ability to create and report a violation 2025-03-19 00:55:14 +01:00