Skip to content

net: Ignore subresource integrity with invalid base64 value#42931

Merged
TimvdLippe merged 3 commits into
servo:mainfrom
Gae24:non-base64-sri
Mar 1, 2026
Merged

net: Ignore subresource integrity with invalid base64 value#42931
TimvdLippe merged 3 commits into
servo:mainfrom
Gae24:non-base64-sri

Conversation

@Gae24

@Gae24 Gae24 commented Mar 1, 2026

Copy link
Copy Markdown
Contributor

Found this while analysing module preload test failures. In particular a subtest of modulepreload.html was recently updated to catch this.
We need to ensure that SRI hash follows the base64 grammar specified by CSP.

Testing: Updated test expectations of a test

@servo-highfive servo-highfive added the S-awaiting-review There is new code that needs to be reviewed. label Mar 1, 2026
@Gae24

Gae24 commented Mar 1, 2026

Copy link
Copy Markdown
Contributor Author

It's possible to defer this to the csp crate, but more changes will probably be needed.

@TimvdLippe TimvdLippe left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs rebase for Cargo.lock

@servo-highfive servo-highfive added S-needs-rebase There are merge conflict errors. and removed S-awaiting-review There is new code that needs to be reviewed. labels Mar 1, 2026
Gae24 added 3 commits March 1, 2026 19:15
Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
@servo-highfive servo-highfive added S-awaiting-review There is new code that needs to be reviewed. and removed S-needs-rebase There are merge conflict errors. labels Mar 1, 2026
@TimvdLippe TimvdLippe enabled auto-merge March 1, 2026 18:24
@TimvdLippe TimvdLippe added this pull request to the merge queue Mar 1, 2026
@servo-highfive servo-highfive added the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Mar 1, 2026
Merged via the queue into servo:main with commit 63d9116 Mar 1, 2026
33 checks passed
@servo-highfive servo-highfive removed the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Mar 1, 2026
simonwuelker pushed a commit to simonwuelker/servo that referenced this pull request Mar 3, 2026
)

Found this while analysing module preload test failures. In particular a
subtest of `modulepreload.html` was recently
[updated](web-platform-tests/wpt#57243) to catch
this.
We need to ensure that SRI hash follows the base64 grammar specified by
CSP.

Testing: Updated test expectations of a test

---------

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
@Gae24 Gae24 deleted the non-base64-sri branch March 8, 2026 19:31
offline-ant pushed a commit to offline-ant/havi that referenced this pull request Jun 4, 2026
)

Found this while analysing module preload test failures. In particular a
subtest of `modulepreload.html` was recently
[updated](web-platform-tests/wpt#57243) to catch
this.
We need to ensure that SRI hash follows the base64 grammar specified by
CSP.

Testing: Updated test expectations of a test

---------

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-awaiting-review There is new code that needs to be reviewed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants