script: Append CSP policies from meta elements by TimvdLippe · Pull Request #43063 · servo/servo

TimvdLippe · 2026-03-06T15:07:13Z

Rather than overwriting the CSP list from a fetch header response, we should add a policy from a meta element to the global CSP list (if it exists).

Fixes #36822
Supersedes and closes #36828

github-actions · 2026-03-06T15:07:32Z

🔨 Triggering try run (#22769179160) for Linux (WPT)

mrobinson

Nice!

Rather than overwriting the CSP list from a fetch header response, we should add a policy from a meta element to the global CSP list (if it exists). Fixes servo#36822 Co-authored-by: Emmanuel Paul Elom <elomemmanuel007@gmail.com> Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>

github-actions · 2026-03-06T15:51:29Z

Test results for linux-wpt from try job (#22769179160):

Flaky unexpected result (21)

OK /_mozilla/mozilla/getBoundingClientRect.html (#39668)
- FAIL [expected PASS] subtest: getBoundingClientRect 1
```
assert_equals: expected 62 but got 60.35
```
CRASH [expected OK] /_webgl/conformance/glsl/bugs/floored-division-accuracy.html
FAIL [expected PASS] /css/css-backgrounds/background-size-042.html
OK [expected ERROR] /fetch/fetch-later/quota/same-origin-iframe/multiple-iframes.https.window.html (#35176)
OK [expected ERROR] /fetch/fetch-later/quota/same-origin-iframe/sandboxed-iframe.https.window.html (#41704)
OK /fetch/metadata/generated/css-font-face.https.sub.tentative.html (#32732)
- PASS [expected FAIL] subtest: sec-fetch-dest
OK /fetch/metadata/generated/css-font-face.sub.tentative.html (#34624)
- PASS [expected FAIL] subtest: sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination
- PASS [expected FAIL] subtest: sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination
TIMEOUT /fetch/metadata/generated/css-images.https.sub.tentative.html (#42229)
- FAIL [expected PASS] subtest: content sec-fetch-site - Cross-Site -> Same-Site
```
assert_unreached: Reached unreachable code
```
OK /html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-reload-location-reload.html (#32595)
- FAIL [expected PASS] subtest: Reloading iframe loading='lazy' before it is loaded: location.reload
```
uncaught exception: Error: assert_equals: expected "http://web-platform.test:8000/html/semantics/embedded-content/the-iframe-element/support/blank.htm?src" but got "about:blank"
```
TIMEOUT [expected OK] /html/semantics/embedded-content/the-iframe-element/iframe_sandbox_navigate_other_frame_popup.sub.html (#39702)
- TIMEOUT [expected FAIL] subtest: Sandboxed iframe can not navigate other frame's popup
```
Test timed out
```
OK /html/semantics/forms/form-submission-0/jsurl-form-submit.tentative.html (#36489)
- PASS [expected FAIL] subtest: Verifies that form submissions scheduled inside javascript: urls take precedence over the javascript: url's return value.
TIMEOUT [expected OK] /html/user-activation/navigation-state-reset-sameorigin.html
- TIMEOUT [expected PASS] subtest: Post-navigation state reset.
```
Test timed out
```
OK /navigation-timing/test-navigation-type-reload.html (#33334)
- FAIL [expected PASS] subtest: Reload domContentLoadedEventEnd > Original domContentLoadedEventEnd
```
assert_true: Reload domContentLoadedEventEnd &gt; Original domContentLoadedEventEnd expected true got false
```
PASS [expected FAIL] /png/apng/acTL-plays-two.html (#41191)
OK [expected TIMEOUT] /trusted-types/trusted-types-navigation.html?06-10 (#37920)
- PASS [expected TIMEOUT] subtest: Navigate a frame via anchor with javascript:-urls w/ default policy in report-only mode.
- FAIL [expected NOTRUN] subtest: Navigate a window via anchor with javascript:-urls w/ a default policy throwing an exception in enforcing mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
- FAIL [expected NOTRUN] subtest: Navigate a window via anchor with javascript:-urls w/ a default policy throwing an exception in report-only mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
OK /trusted-types/trusted-types-navigation.html?21-25
- FAIL [expected PASS] subtest: Navigate a window via form-submission with javascript:-urls in enforcing mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
OK [expected TIMEOUT] /trusted-types/trusted-types-navigation.html?26-30 (#38807)
- PASS [expected TIMEOUT] subtest: Navigate a window via form-submission with javascript:-urls in report-only mode.
- PASS [expected NOTRUN] subtest: Navigate a window via form-submission with javascript:-urls w/ default policy in report-only mode.
- PASS [expected NOTRUN] subtest: Navigate a frame via form-submission with javascript:-urls in enforcing mode.
- PASS [expected NOTRUN] subtest: Navigate a frame via form-submission with javascript:-urls w/ default policy in enforcing mode.
OK [expected TIMEOUT] /trusted-types/trusted-types-navigation.html?31-35 (#38034)
- PASS [expected TIMEOUT] subtest: Navigate a frame via form-submission with javascript:-urls w/ default policy in report-only mode.
- FAIL [expected NOTRUN] subtest: Navigate a window via form-submission with javascript:-urls w/ a default policy throwing an exception in enforcing mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
- FAIL [expected NOTRUN] subtest: Navigate a window via form-submission with javascript:-urls w/ a default policy throwing an exception in report-only mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
- FAIL [expected NOTRUN] subtest: Navigate a window via form-submission with javascript:-urls w/ a default policy making the URL invalid in enforcing mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
OK /visual-viewport/resize-event-order.html (#41981)
- PASS [expected FAIL] subtest: Popup: DOMWindow resize fired before VisualViewport.
OK [expected TIMEOUT] /webstorage/localstorage-about-blank-3P-iframe-opens-3P-window.partitioned.html (#29053)
- PASS [expected TIMEOUT] subtest: StorageKey: test 3P about:blank window opened from a 3P iframe
CRASH [expected OK] /workers/constructors/Worker/ctor-1.html

Stable unexpected results that are known to be intermittent (20)

FAIL [expected PASS] /_mozilla/mozilla/sslfail.html (#10760)
TIMEOUT [expected OK] /_mozilla/mozilla/window_resize_event.html (#36741)
- TIMEOUT [expected PASS] subtest: Popup onresize event fires after resizeTo
```
Test timed out
```
OK /_webgl/conformance/textures/misc/texture-upload-size.html (#21770)
- PASS [expected FAIL] subtest: WebGL test #45
- PASS [expected FAIL] subtest: WebGL test #47
- PASS [expected FAIL] subtest: WebGL test #49
- PASS [expected FAIL] subtest: WebGL test #51
- FAIL [expected PASS] subtest: WebGL test #53
```
assert_true: Texture was smaller than the expected size 2x2 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #55
```
assert_true: getError expected: INVALID_VALUE. Was NO_ERROR : when calling texSubImage2D with the same texture upload with offset 1, 1 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #57
```
assert_true: Texture was smaller than the expected size 2x2 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #59
```
assert_true: getError expected: INVALID_VALUE. Was NO_ERROR : when calling texSubImage2D with the same texture upload with offset 1, 1 expected true got false
```
- PASS [expected FAIL] subtest: WebGL test #61
- PASS [expected FAIL] subtest: WebGL test #63
- And 10 more unexpected results...
OK /content-security-policy/frame-ancestors/frame-ancestors-path-ignored.window.html (#36468)
- FAIL [expected PASS] subtest: A 'frame-ancestors' CSP directive with a URL that includes a path should be ignored.
```
assert_unreached: The IFrame should have been blocked (or cross-origin). It wasn't. Reached unreachable code
```
OK /css/css-fonts/generic-family-keywords-001.html (#37467)
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(fangsong)
```
assert_equals: quoted generic(fangsong) matches  @font-face rule expected 50 but got 30
```
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(nastaliq)
```
assert_equals: quoted generic(nastaliq) matches  @font-face rule expected 50 but got 30
```
OK /css/css-fonts/generic-family-keywords-003.html (#38994)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted fantasy (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted monospace (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted system-ui (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted generic(fangsong) (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted generic(kai) (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted generic(khmer-mul) (drawing text in a canvas)
- PASS [expected FAIL] subtest: @font-face matching for quoted and unquoted ui-serif (drawing text in a canvas)
OK [expected ERROR] /focus/focus-event-after-switching-iframes.sub.html (#40368)
OK [expected TIMEOUT] /html/anonymous-iframe/indexeddb.tentative.https.window.html (#39254)
- FAIL [expected TIMEOUT] subtest: indexeddb
```
assert_equals: expected (undefined) undefined but got (string) "f65209cd-5c5b-4aad-b0e0-8b7750d773d1"
```
OK /html/browsers/browsing-the-web/navigating-across-documents/005.html (#27062)
- PASS [expected FAIL] subtest: Link with onclick navigation and href navigation
OK /html/browsers/browsing-the-web/navigating-across-documents/navigation-unload-cross-origin.sub.window.html (#29056)
- PASS [expected FAIL] subtest: Cross-origin navigation started from unload handler must be ignored
OK /html/browsers/browsing-the-web/navigating-across-documents/navigation-unload-same-origin-fragment.html (#20768)
- FAIL [expected PASS] subtest: Tests that a fragment navigation in the unload handler will not block the initial navigation
```
assert_equals: expected "" but got "#fragment"
```
OK /html/browsers/history/the-history-interface/traverse_the_history_2.html (#21383)
- FAIL [expected PASS] subtest: Multiple history traversals, last would be aborted
```
assert_array_equals: Pages opened during history navigation lengths differ, expected array [6, 3] length 2, got [6, 2, 2] length 3
```
OK /html/browsers/history/the-history-interface/traverse_the_history_4.html (#21383)
- FAIL [expected PASS] subtest: Multiple history traversals, last would be aborted
```
assert_array_equals: Pages opened during history navigation expected property 1 to be 5 but got 3 (expected array [6, 5] got [6, 3])
```
OK /html/browsers/history/the-history-interface/traverse_the_history_5.html (#21383)
- FAIL [expected PASS] subtest: Multiple history traversals, last would be aborted
```
assert_array_equals: Pages opened during history navigation expected property 1 to be 5 but got 3 (expected array [6, 5] got [6, 3])
```
CRASH [expected TIMEOUT] /html/browsers/history/the-location-interface/location_replace_session_history.html (#41896)
TIMEOUT /html/interaction/focus/the-autofocus-attribute/supported-elements.html (#24145)
- TIMEOUT [expected PASS] subtest: Non-HTMLElement should not support autofocus
```
Test timed out
```
- NOTRUN [expected TIMEOUT] subtest: Host element with delegatesFocus should support autofocus
TIMEOUT /html/semantics/embedded-content/media-elements/autoplay-default-feature-policy.https.sub.html (#41193)
- PASS [expected TIMEOUT] subtest: Default "autoplay" feature policy ["self"] allows same-origin iframes.
OK /resource-timing/test_resource_timing.html (#25720)
- PASS [expected FAIL] subtest: PerformanceEntry has correct name, initiatorType, startTime, and duration (img)
- FAIL [expected PASS] subtest: PerformanceEntry has correct name, initiatorType, startTime, and duration (link)
```
assert_equals: expected 7.190000000000001 but got 7.19
```
OK /resource-timing/test_resource_timing.https.html (#25216)
- PASS [expected FAIL] subtest: PerformanceEntry has correct name, initiatorType, startTime, and duration (link)
OK /touch-events/single-tap-when-touchend-listener-use-sync-xhr.html (#41175)
- PASS [expected FAIL] subtest: Click event should be fired when touchend opens synchronous XHR

github-actions · 2026-03-06T15:53:22Z

✨ Try run (#22769179160) succeeded.

Rather than overwriting the CSP list from a fetch header response, we should add a policy from a meta element to the global CSP list (if it exists). Fixes servo#36822 Supersedes and closes servo#36828 Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com> Co-authored-by: Emmanuel Paul Elom <elomemmanuel007@gmail.com> (cherry picked from commit c8c2136)

TimvdLippe requested a review from gterzian as a code owner March 6, 2026 15:07

TimvdLippe added the T-linux-wpt Do a try run of the WPT label Mar 6, 2026

servo-highfive added the S-awaiting-review There is new code that needs to be reviewed. label Mar 6, 2026

github-actions Bot removed the T-linux-wpt Do a try run of the WPT label Mar 6, 2026

mrobinson approved these changes Mar 6, 2026

View reviewed changes

Comment thread components/script/dom/html/htmlmetaelement.rs Outdated

servo-highfive removed the S-awaiting-review There is new code that needs to be reviewed. label Mar 6, 2026

TimvdLippe force-pushed the append-csp-list branch from 25c2065 to 0ecb318 Compare March 6, 2026 15:33

servo-highfive added the S-awaiting-review There is new code that needs to be reviewed. label Mar 6, 2026

TimvdLippe added this pull request to the merge queue Mar 6, 2026

servo-highfive added the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Mar 6, 2026

Merged via the queue into servo:main with commit c8c2136 Mar 6, 2026
34 checks passed

TimvdLippe deleted the append-csp-list branch March 6, 2026 17:16

servo-highfive removed the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Mar 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

script: Append CSP policies from meta elements#43063

script: Append CSP policies from meta elements#43063
TimvdLippe merged 1 commit into
servo:mainfrom
TimvdLippe:append-csp-list

TimvdLippe commented Mar 6, 2026

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

mrobinson left a comment

Uh oh!

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

TimvdLippe commented Mar 6, 2026

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

mrobinson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

github-actions Bot commented Mar 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants