Implement Content Security Policy (CSP).

[Ms2ger]

Depends on #4576.

Estimated 2 months work assuming the right hooks.

[notriddle]

https://github.com/notriddle/rust-content-security-policy

I started working on it for Ammonia's purposes, but after looking around for an existing implementation, decided that if Servo needs it then here it is.

[jdm]

No I don't think that's what's missing here. https://github.com/servo/servo/tree/main/tests/wpt/tests/content-security-policy/child-src are tests that are supposed to run when Destination::Frame is set: (https://github.com/servo/rust-content-security-policy/blob/334bfcbf0a3f503b21c90aee6aee30d4b8c9558a/src/lib.rs#L1478 coming from https://github.com/servo/rust-content-security-policy/blob/334bfcbf0a3f503b21c90aee6aee30d4b8c9558a/src/lib.rs#L1499). That's set in

servo/components/net/fetch/methods.rs

Line 177 in fdb9c0a
destination: request.destination,
which comes from

servo/components/shared/net/request.rs

Line 396 in fdb9c0a
pub fn destination(mut self, destination: Destination) -> RequestBuilder {

When I look into the callsides of that builder, I never see any codepath set it to Destination::Frame. I also am missing the codepath from the iframe code into this. Can you point me to the location where the iframe code eventually flows into the RequestBuilder code and where I would need to set the destination for it?

I remember looking for a frame destination in the specification, and I think.it might be missing. Our iframe navigation code creates a LoadData in htmliframeelement.rs and passes it to the constellation, where a pipeline is spawned in an appropriate script thread:

servo/components/script/script_thread.rs

Line 3531 in a24fce3

.initiate_fetch(&self.resource_threads.core_thread, None);

servo/components/script/script_thread.rs

Line 3664 in a24fce3

.initiate_fetch(&self.resource_threads.core_thread, response_init);

is another caller that handles redirects.

[jdm]

Looks like it's currently always the document destination: https://github.com/servo/servo/blob/main/components/script/navigation.rs#L205

[jdm]

I filed whatwg/html#11306.