Append to existing CSP list in Document::set_csp_list #36828

elomscansio · 2025-05-04T00:41:55Z

The Document::set_csp_list method now appends new policies to any
existing CspList rather than replacing it. This ensures that CSPs
from multiple sources (e.g., HTTP headers and <meta> tags) are
merged as expected, following the spec.

This change avoids silently discarding header-defined policies when
a <meta http-equiv="Content-Security-Policy"> is present in the
document.

./mach build -d does not report any errors
./mach test-tidy does not report any errors
These changes fix CSP from <meta> overrides any existing CSP #36822
There are tests for these changes (if applicable)

jdm

Thank you!

jdm · 2025-05-04T13:38:37Z

@TimvdLippe There are some trusted types failures with this change that might interest you!

TimvdLippe · 2025-05-04T14:45:04Z

Are we sure this is the right behaviour? I thought that CSP lists would override and only inherit for local iframes.

jdm · 2025-05-04T16:34:00Z

Hmm. The intent here is that CSP lists from meta elements are appended to any CSP list received in the headers for a document. We may need to be more selective about this behavior change.

jdm · 2025-05-04T16:37:47Z

I was reading https://www.w3.org/TR/CSP/#multiple-policies as supporting this use case, and the note under https://www.w3.org/TR/CSP/#meta-element seems to reinforce this.

TimvdLippe · 2025-05-04T16:58:39Z

I see no new WPT pass with this change. Does that mean the behaviour is untested (unlikely, but possible) or we already pass it or the patch is insufficient? I would expect at least one test to pass with this fix and then we can look into why the other ones started failing.

jdm · 2025-05-04T17:04:40Z

Yeah, it's worth writing a new test that checks this case explicitly.

elomscansio · 2025-05-05T00:37:11Z

i'm tryna add test but no assert is run

servo-wpt-sync · 2025-05-05T00:38:41Z

🤖 Opened new upstream WPT pull request (web-platform-tests/wpt#52322) with upstreamable changes.

jdm · 2025-05-05T03:32:46Z

i'm tryna add test but no assert is run

The test throws an exception because the first policy is blocked by CSP—using the same directive name (trusted-types) for both CSP lists won't work, because each check needs to pass both rules. Instead we need to have rules for two different things (eg. img-src and media-src) and verify that both are blocked as expected.

elomscansio · 2025-05-05T11:42:51Z

i'm tryna add test but no assert is run

The test throws an exception because the first policy is blocked by CSP—using the same directive name (trusted-types) for both CSP lists won't work, because each check needs to pass both rules. Instead we need to have rules for two different things (eg. img-src and media-src) and verify that both are blocked as expected.

just pushed, I used script-src instead of media-src, I could not find video file to load

servo-wpt-sync · 2025-05-05T11:43:47Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

TimvdLippe · 2025-05-05T13:58:16Z

components/script/dom/document.rs

+        if let Some(new_list) = csp_list {
+            let mut current = self.get_csp_list();
+            match current {
+                Some(ref mut existing) => existing.append(new_list),
+                None => current = Some(new_list),
+            }
+            self.policy_container.borrow_mut().set_csp_list(current);
+        }


Looking at the test failures, I think this patch is incorrect. The test in question has the following:

<meta http-equiv="Content-Security-Policy" content="trusted-types 'none'"> <meta http-equiv="Content-Security-Policy" content="connect-src 'none'">

It has no CSP headers, so the only thing here are the meta elements.

Based on this patch, I see that it does two things when the second meta element is parsed:

It adds the new list to current (by mutating the object)

It sets the new list.

Notably, it doesn't clone the list, like the other implementation does. I don't know enough Rust, but I have a feeling that means it gets duplicated somehow.

Lastly, shouldn't we update the policy_container.set_csp_list instead of only the set_csp_list on document? We also have it on Window, so why are we only updating a single version of it?

All in all, it is unlikely to me that the Trusted Types code is wrong. Instead, I think the logic here somehow ends up duplicating the list the contents of the list twice.

Suggested change

if let Some(new_list) = csp_list {

let mut current = self.get_csp_list();

match current {

Some(ref mut existing) => existing.append(new_list),

None => current = Some(new_list),

}

self.policy_container.borrow_mut().set_csp_list(current);

}

if let Some(new_list) = csp_list {

let new_list = match self.get_csp_list() {

Some(original_list) => {

let mut combined_list = original_list.clone();

combined_list.append(new_list);

combined_list

},

None => new_list,

}

self.policy_container.borrow_mut().set_csp_list(Some(new_list));

}

Can you try with this patch and see if the Trusted Types tests still fail?

Lastly, shouldn't we update the policy_container.set_csp_list instead of only the set_csp_list on document? We also have it on Window, so why are we only updating a single version of it?

The only copy of the CSP list is in the policy container that lives in the document:

servo/components/script/dom/globalscope.rs

Lines 3041 to 3044 in ffccc5c

pub fn get_csp_list(&self) -> Option<CspList> {

if let Some(window) = self.downcast::<Window>() {

return window.Document().get_csp_list().map(|c| c.clone());

}

Notably, it doesn't clone the list, like the other implementation does. I don't know enough Rust, but I have a feeling that means it gets duplicated somehow.

No cloning is required. Document::get_csp_list already returns a clone, so the clone is updated and the original value is overwritten by the updated value.

i added another same test to confirm the multiple meta header and its passing which did not help,
add added logging to the failing test (tests/wpt/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html, https://github.com/elomscansio/servo/blob/9fe700f23d9d24e307d1d3925a20ddcbb1da25c8/tests/wpt/tests/trusted-types/support/csp-violations.js#L22-L23) js and it turned out that the trusted-type in being thrown twice which i don't know why

0:07.42 pid:17791 0 ......................... 0:07.42 pid:17791 isTrusted true 0:07.42 pid:17791 documentURI http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.42 pid:17791 referrer http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.42 pid:17791 blockedURI trusted-types-policy 0:07.42 pid:17791 effectiveDirective trusted-types 0:07.42 pid:17791 violatedDirective trusted-types 0:07.42 pid:17791 originalPolicy trusted-types 'none' 0:07.42 pid:17791 sourceFile http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.42 pid:17791 sample SomeName 0:07.42 pid:17791 disposition enforce 0:07.42 pid:17791 statusCode 200 0:07.42 pid:17791 lineNumber 14 0:07.42 pid:17791 columnNumber 27 0:07.42 pid:17791 composedPath function composedPath() { 0:07.42 pid:17791 [native code] 0:07.42 pid:17791 } 0:07.42 pid:17791 stopPropagation function stopPropagation() { 0:07.42 pid:17791 [native code] 0:07.42 pid:17791 } 0:07.42 pid:17791 stopImmediatePropagation function stopImmediatePropagation() { 0:07.42 pid:17791 [native code] 0:07.42 pid:17791 } 0:07.42 pid:17791 preventDefault function preventDefault() { 0:07.42 pid:17791 [native code] 0:07.42 pid:17791 } 0:07.42 pid:17791 initEvent function initEvent() { 0:07.42 pid:17791 [native code] 0:07.42 pid:17791 } 0:07.42 pid:17791 type securitypolicyviolation 0:07.43 pid:17791 target … 0:07.43 pid:17791 srcElement … 0:07.44 pid:17791 currentTarget … 0:07.44 pid:17791 eventPhase 2 0:07.44 pid:17791 cancelBubble false 0:07.44 pid:17791 bubbles true 0:07.44 pid:17791 cancelable true 0:07.44 pid:17791 returnValue true 0:07.44 pid:17791 defaultPrevented false 0:07.44 pid:17791 composed false 0:07.44 pid:17791 timeStamp 2530.83 0:07.44 pid:17791 NONE 0 0:07.44 pid:17791 CAPTURING_PHASE 1 0:07.44 pid:17791 AT_TARGET 2 0:07.44 pid:17791 BUBBLING_PHASE 3 0:07.44 pid:17791 0:07.44 pid:17791 1 ......................... 0:07.44 pid:17791 isTrusted true 0:07.44 pid:17791 documentURI http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.44 pid:17791 referrer http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.44 pid:17791 blockedURI trusted-types-policy 0:07.44 pid:17791 effectiveDirective trusted-types 0:07.44 pid:17791 violatedDirective trusted-types 0:07.44 pid:17791 originalPolicy trusted-types 'none' 0:07.44 pid:17791 sourceFile http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.44 pid:17791 sample SomeName 0:07.44 pid:17791 disposition enforce 0:07.44 pid:17791 statusCode 200 0:07.44 pid:17791 lineNumber 14 0:07.44 pid:17791 columnNumber 27 0:07.45 pid:17791 composedPath function composedPath() { 0:07.45 pid:17791 [native code] 0:07.45 pid:17791 } 0:07.45 pid:17791 stopPropagation function stopPropagation() { 0:07.45 pid:17791 [native code] 0:07.45 pid:17791 } 0:07.45 pid:17791 stopImmediatePropagation function stopImmediatePropagation() { 0:07.45 pid:17791 [native code] 0:07.45 pid:17791 } 0:07.45 pid:17791 preventDefault function preventDefault() { 0:07.45 pid:17791 [native code] 0:07.45 pid:17791 } 0:07.45 pid:17791 initEvent function initEvent() { 0:07.45 pid:17791 [native code] 0:07.45 pid:17791 } 0:07.45 pid:17791 type securitypolicyviolation 0:07.45 pid:17791 target … 0:07.45 pid:17791 srcElement … 0:07.45 pid:17791 currentTarget … 0:07.45 pid:17791 eventPhase 2 0:07.45 pid:17791 cancelBubble false 0:07.45 pid:17791 bubbles true 0:07.45 pid:17791 cancelable true 0:07.45 pid:17791 returnValue true 0:07.45 pid:17791 defaultPrevented false 0:07.45 pid:17791 composed false 0:07.45 pid:17791 timeStamp 2552.05 0:07.45 pid:17791 NONE 0 0:07.45 pid:17791 CAPTURING_PHASE 1 0:07.45 pid:17791 AT_TARGET 2 0:07.45 pid:17791 BUBBLING_PHASE 3 0:07.45 pid:17791 0:07.46 pid:17791 2 ......................... 0:07.46 pid:17791 isTrusted true 0:07.46 pid:17791 documentURI http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.46 pid:17791 referrer http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:07.46 pid:17791 blockedURI ws://common/blank.html 0:07.46 pid:17791 effectiveDirective connect-src 0:07.46 pid:17791 violatedDirective connect-src 0:07.46 pid:17791 originalPolicy connect-src 'none' 0:07.46 pid:17791 sourceFile 0:07.46 pid:17791 sample 0:07.46 pid:17791 disposition enforce 0:07.46 pid:17791 statusCode 200 0:07.46 pid:17791 lineNumber 0 0:07.46 pid:17791 columnNumber 1 0:07.46 pid:17791 composedPath function composedPath() { 0:07.46 pid:17791 [native code] 0:07.46 pid:17791 } 0:07.46 pid:17791 stopPropagation function stopPropagation() { 0:07.46 pid:17791 [native code] 0:07.46 pid:17791 } 0:07.46 pid:17791 stopImmediatePropagation function stopImmediatePropagation() { 0:07.46 pid:17791 [native code] 0:07.46 pid:17791 } 0:07.46 pid:17791 preventDefault function preventDefault() { 0:07.46 pid:17791 [native code] 0:07.46 pid:17791 } 0:07.46 pid:17791 initEvent function initEvent() { 0:07.46 pid:17791 [native code] 0:07.46 pid:17791 } 0:07.46 pid:17791 type securitypolicyviolation 0:07.46 pid:17791 target … 0:07.46 pid:17791 srcElement … 0:07.47 pid:17791 currentTarget … 0:07.47 pid:17791 eventPhase 2 0:07.47 pid:17791 cancelBubble false 0:07.47 pid:17791 bubbles true 0:07.47 pid:17791 cancelable true 0:07.47 pid:17791 returnValue true 0:07.47 pid:17791 defaultPrevented false 0:07.47 pid:17791 composed false 0:07.47 pid:17791 timeStamp 2566.36 0:07.47 pid:17791 NONE 0 0:07.47 pid:17791 CAPTURING_PHASE 1 0:07.47 pid:17791 AT_TARGET 2 0:07.47 pid:17791 BUBBLING_PHASE 3

maybe there are some other places that policy_container are updated

Can you add some printlns in your function to print csp_list.to_string() and see if the directive is twice in it? I used that before to debug the contents of the list. You can also add this to the getter, so that you can always see when it is retrieved what the value is.

our problem stems from

servo/components/script/dom/htmlmetaelement.rs

Line 69 in c6de8fc

"content-security-policy" => self.apply_csp_list(),

servo/components/script/dom/htmlmetaelement.rs

Line 122 in c6de8fc

head.set_content_security_policy();

servo/components/script/dom/htmlheadelement.rs

Lines 67 to 96 in c6de8fc

let candidates = node

.traverse_preorder(ShadowIncluding::No)

.filter_map(DomRoot::downcast::<Element>)

.filter(|elem| elem.is::<HTMLMetaElement>())

.filter(|elem| {

elem.get_string_attribute(&local_name!("http-equiv"))

.to_ascii_lowercase() ==

*"content-security-policy"

})

.filter(|elem| {

elem.get_attribute(&ns!(), &local_name!("content"))

.is_some()

});

for meta in candidates {

if let Some(ref content) = meta.get_attribute(&ns!(), &local_name!("content")) {

let content = content.value();

let content_val = content.trim();

if !content_val.is_empty() {

let policies =

CspList::parse(content_val, PolicySource::Meta, PolicyDisposition::Enforce);

match csp_list {

Some(ref mut csp_list) => csp_list.append(policies),

None => csp_list = Some(policies),

}

}

}

}

doc.set_csp_list(csp_list);

on every meta element that we bind_to_tree it transverse the whole tree and gets all the connected metas.
And i think we are doing unnecessary work, since meta is the only valid element to carry the csp props we can just push the csp directly to doc

see the log

elomscansio@elomscansio:~/Desktop/projects/servo $ ./mach test-wpt tests/wpt/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html No build type specified so assuming `--dev`. Running WPT tests with /home/elomscansio/Desktop/projects/servo/target/debug/servo 0:04.79 wptserve INFO Starting http server on http://127.0.0.1:8001 0:04.84 wptserve INFO Starting http server on http://127.0.0.1:8002 0:04.91 wptserve INFO Create socket on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.93 wptserve INFO Create socket on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.94 wptserve INFO Bind on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.94 wptserve INFO Bind on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.94 wptserve INFO Listen on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.94 wptserve INFO Listen on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:04.94 wptserve INFO Skip by failure: OSError(98, 'Address already in use') 0:05.00 wptserve INFO Create socket on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Create socket on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Bind on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Bind on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Listen on: (<AddressFamily.AF_INET6: 10>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Listen on: (<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, '', '', '') 0:05.00 wptserve INFO Skip by failure: OSError(98, 'Address already in use') 0:05.03 wptserve INFO Starting https server on https://127.0.0.1:8443 0:05.04 wptserve INFO Starting https server on https://127.0.0.1:8446 0:05.10 wptserve INFO Starting https server on https://127.0.0.1:8445 0:05.12 wptserve INFO Starting https server on https://127.0.0.1:8444 0:05.12 wptserve INFO Starting http2 server on https://127.0.0.1:9000 0:05.13 wptserve INFO Starting http server on http://127.0.0.1:8000 0:05.14 wptserve INFO Starting http server on http://127.0.0.1:8003 0:05.57 SUITE_START: web-platform-test - running 1 tests 0:05.58 INFO Using 1 child processes 0:05.58 INFO Starting runner 0:06.00 TEST_START: /trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html 0:06.00 WARNING Got command init_succeeded in state running 0:20.11 pid:7793 Full command: /home/elomscansio/Desktop/projects/servo/target/debug/servo --hard-fail -u Servo/wptrunner --ignore-certificate-errors --enable-experimental-web-platform-features http://web-platform.test:8000/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html --user-stylesheet /home/elomscansio/Desktop/projects/servo/resources/ahem.css --pref dom_testutils_enabled=true --pref dom_urlpattern_enabled=true --prefs-file /home/elomscansio/Desktop/projects/servo/resources/wpt-prefs.json --certificate-path /home/elomscansio/Desktop/projects/servo/tests/wpt/tests/tools/certs/cacert.pem pid:7793 new csp list "trusted-types 'none'" 0:20.12 pid:7793 csp list after update "trusted-types 'none'" 0:20.12 pid:7793 new csp list "trusted-types 'none',connect-src 'none'" 0:20.12 pid:7793 csp list before update "trusted-types 'none'" 0:20.12 pid:7793 csp list after update "trusted-types 'none',trusted-types 'none',connect-src 'none'" 0:20.69 pid:7793

0:20.12 pid:7793 new csp list "trusted-types 'none',connect-src 'none'" the new csp list still includes what we've added before

@jdm @TimvdLippe @PotatoCP I made few changes i'm not sure whether it complies with spec

servo-wpt-sync · 2025-05-05T17:20:05Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

servo-wpt-sync · 2025-05-06T13:32:09Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

PotatoCP · 2025-05-07T06:22:08Z

tests/wpt/tests/content-security-policy/meta/meta-append-header.html

+      });
+    }, "script without `abc` nonce is blocked by header CSP");
+  </script>
+</body>


I think it's better to add newline at the end of the file. Same for tests/wpt/tests/content-security-policy/meta/meta-multiple-csp.html

servo-wpt-sync · 2025-05-08T00:50:37Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

servo-wpt-sync · 2025-05-10T14:25:03Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

servo-wpt-sync · 2025-05-10T23:03:52Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

elomscansio · 2025-05-13T00:42:11Z

ping

TimvdLippe

I don't have maintainer's rights on this repository, but from my perspective this PR looks good to me. Can you run a try run on your fork to see if this fixes any issues? You can do so with ./mach try wpt

elomscansio · 2025-05-17T00:29:45Z

./mach try wpt

wow, Thanks

TimvdLippe · 2025-05-17T05:02:33Z

I see you ran it successfully in https://github.com/elomscansio/servo/actions/runs/15079633979 Note that the single test failure has already been resolved on main. If you git rebase main your branch and run WPT again, it should pass.

Signed-off-by: Emmanuel Paul Elom <elomemmanuel007@gmail.com>

servo-wpt-sync · 2025-05-17T08:55:43Z

📝 Transplanted new upstreamable changes to existing upstream WPT pull request (web-platform-tests/wpt#52322).

TimvdLippe · 2025-05-18T05:36:47Z

I found this WPT test that might be a duplicate https://github.com/web-platform-tests/wpt/blob/master/content-security-policy/meta/combine-header-and-meta-policies.sub.html I wonder why that doesn't pass with this PR?

yezhizhen · 2025-08-29T10:08:02Z

@TimvdLippe This PR has been here for a while. I'm curious what's your opinion: is it still relevant?

TimvdLippe · 2025-08-29T11:19:29Z

We are currently still failing https://wpt.fyi/results/content-security-policy/meta/combine-header-and-meta-policies.sub.html?product=servo so I think this fix is still relevant. Therefore, we don't need to introduce a new WPT test for this. Can you remove the new test and make the existing one pass?

elomscansio requested a review from gterzian as a code owner May 4, 2025 00:41

elomscansio mentioned this pull request May 4, 2025

CSP from <meta> overrides any existing CSP #36822

Open

elomscansio force-pushed the csp_from_meta branch from acf0549 to 6f50cd8 Compare May 4, 2025 00:47

jdm approved these changes May 4, 2025

View reviewed changes

jdm added this pull request to the merge queue May 4, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks May 4, 2025

elomscansio force-pushed the csp_from_meta branch from 6f50cd8 to d0f266d Compare May 5, 2025 00:36

servo-wpt-sync mentioned this pull request May 5, 2025

Append to existing CSP list in Document::set_csp_list web-platform-tests/wpt#52322

Open

elomscansio force-pushed the csp_from_meta branch from d0f266d to 748110f Compare May 5, 2025 11:41

TimvdLippe reviewed May 5, 2025

View reviewed changes

elomscansio force-pushed the csp_from_meta branch from 5d888d9 to 9fe700f Compare May 6, 2025 13:29

PotatoCP reviewed May 7, 2025

View reviewed changes

elomscansio requested review from PotatoCP, TimvdLippe and jdm May 8, 2025 00:46

elomscansio force-pushed the csp_from_meta branch from 9fe700f to 44abbdf Compare May 8, 2025 00:47

elomscansio force-pushed the csp_from_meta branch from 44abbdf to 8e08c28 Compare May 10, 2025 14:22

elomscansio force-pushed the csp_from_meta branch from 8e08c28 to 24ab4ee Compare May 10, 2025 23:01

TimvdLippe reviewed May 14, 2025

View reviewed changes

script: Append to existing CSP list in set_csp_list

7e61cee

Signed-off-by: Emmanuel Paul Elom <elomemmanuel007@gmail.com>

elomscansio force-pushed the csp_from_meta branch from 24ab4ee to 7e61cee Compare May 17, 2025 08:53

TimvdLippe mentioned this pull request Jun 22, 2025

Move CSP code into one entrypoint #37604

Merged

	pub fn get_csp_list(&self) -> Option<CspList> {
	if let Some(window) = self.downcast::<Window>() {
	return window.Document().get_csp_list().map(\|c\| c.clone());
	}

	let candidates = node
	.traverse_preorder(ShadowIncluding::No)
	.filter_map(DomRoot::downcast::<Element>)
	.filter(\|elem\| elem.is::<HTMLMetaElement>())
	.filter(\|elem\| {
	elem.get_string_attribute(&local_name!("http-equiv"))
	.to_ascii_lowercase() ==
	*"content-security-policy"
	})
	.filter(\|elem\| {
	elem.get_attribute(&ns!(), &local_name!("content"))
	.is_some()
	});

	for meta in candidates {
	if let Some(ref content) = meta.get_attribute(&ns!(), &local_name!("content")) {
	let content = content.value();
	let content_val = content.trim();
	if !content_val.is_empty() {
	let policies =
	CspList::parse(content_val, PolicySource::Meta, PolicyDisposition::Enforce);
	match csp_list {
	Some(ref mut csp_list) => csp_list.append(policies),
	None => csp_list = Some(policies),
	}
	}
	}
	}

	doc.set_csp_list(csp_list);

Uh oh!

Append to existing CSP list in Document::set_csp_list #36828

Are you sure you want to change the base?

Append to existing CSP list in Document::set_csp_list #36828

Uh oh!

Conversation

elomscansio commented May 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jdm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jdm commented May 4, 2025

Uh oh!

TimvdLippe commented May 4, 2025

Uh oh!

jdm commented May 4, 2025

Uh oh!

jdm commented May 4, 2025

Uh oh!

TimvdLippe commented May 4, 2025

Uh oh!

jdm commented May 4, 2025

Uh oh!

elomscansio commented May 5, 2025

Uh oh!

servo-wpt-sync commented May 5, 2025

Uh oh!

jdm commented May 5, 2025

Uh oh!

elomscansio commented May 5, 2025

Uh oh!

servo-wpt-sync commented May 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elomscansio May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elomscansio May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elomscansio May 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

servo-wpt-sync commented May 5, 2025

Uh oh!

servo-wpt-sync commented May 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

servo-wpt-sync commented May 8, 2025

Uh oh!

servo-wpt-sync commented May 10, 2025

Uh oh!

servo-wpt-sync commented May 10, 2025

Uh oh!

elomscansio commented May 13, 2025

Uh oh!

TimvdLippe left a comment

Choose a reason for hiding this comment

Uh oh!

elomscansio commented May 4, 2025 •

edited

Loading

elomscansio May 6, 2025 •

edited

Loading

elomscansio May 6, 2025 •

edited

Loading

elomscansio May 10, 2025 •

edited

Loading

yezhizhen commented Aug 29, 2025 •

edited

Loading