Commit Graph

68 Commits

Author SHA1 Message Date
Shannon Booth
cc6e048bd6 LibWeb+LibIDL: Remove support for #import directives during parsing
These no longer serve any purpose now that we run the IDLGenerator
on all of these files at once.
2026-04-24 20:08:29 +02:00
Shannon Booth
fd44da6829 LibWeb/Bindings: Emit one bindings header and cpp per IDL
Previously, the LibWeb bindings generator would output multiple per
interface files like Prototype/Constructor/Namespace/GlobalMixin
depending on the contents of that IDL file.

This complicates the build system as it means that it does not know
what files will be generated without knowledge of the contents of that
IDL file.

Instead, for each IDL file only generate a single Bindings/<IDLFile>.h
and Bindings/<IDLFile>.cpp.
2026-04-21 07:36:13 +02:00
Shannon Booth
bb0f244667 LibWeb: Remove ShadowRealm HTML integration 2026-04-05 13:57:58 +02:00
Shannon Booth
f27bc38aa7 Everywhere: Remove ShadowRealm support
The proposal has not seemed to progress for a while, and there is
a open issue about module imports which breaks HTML integration.
While we could probably make an AD-HOC change to fix that issue,
it is deep enough in the JS engine that I am not particularly
keen on making that change.

Until other browsers begin to make positive signals about shipping
ShadowRealms, let's remove our implementation for now.

There is still some cleanup that can be done with regard to the
HTML integration, but there are a few more items that need to be
untangled there.
2026-04-05 13:57:58 +02:00
Shannon Booth
46cd47753f LibWeb: Make more use of Value::{as,as_if,is} in LibWeb 2026-02-28 10:24:37 -05:00
Shannon Booth
26cf55dc77 LibWeb/CSP: Prefer use of Optional<StringView> for algorithm matching
Over using the null state of StringView.
2026-02-21 12:37:44 +01:00
Tim Ledbetter
3991555439 LibWeb: Block opaque origins in CSP frame-ancestors check
This matches the behavior of other engines.
2026-02-21 12:30:48 +01:00
Luke Wilde
fc13f15193 LibWeb/CSP: Apply strict-dynamic to inline scripts
This implements https://github.com/w3c/webappsec-csp/pull/787 that
fixed the linked spec issue.
2026-02-19 14:58:09 +01:00
Aliaksandr Kalenik
901cc28272 LibWeb: Reduce recompilation impact of DOM/Document.h
Remove 11 heavy includes from Document.h that were only needed for
pointer/reference types (already forward-declared in Forward.h), and
extract the nested ViewportClient interface to a standalone header.

This reduces Document.h's recompilation cascade from ~1228 files to
~717 files (42% reduction). Headers like BrowsingContext.h that were
previously transitively included see even larger improvements (from
~1228 down to ~73 dependents).
2026-02-11 20:02:28 +01:00
Timothy Flynn
9375660b64 LibHTTP+LibWeb+RequestServer: Move Fetch's HTTP header infra to LibHTTP
The end goal here is for LibHTTP to be the home of our RFC 9111 (HTTP
caching) implementation. We currently have one implementation in LibWeb
for our in-memory cache and another in RequestServer for our disk cache.

The implementations both largely revolve around interacting with HTTP
headers. But in LibWeb, we are using Fetch's header infra, and in RS we
are using are home-grown header infra from LibHTTP.

So to give these a common denominator, this patch replaces the LibHTTP
implementation with Fetch's infra. Our existing LibHTTP implementation
was not particularly compliant with any spec, so this at least gives us
a standards-based common implementation.

This migration also required moving a handful of other Fetch AOs over
to LibHTTP. (It turns out these AOs were all from the Fetch/Infra/HTTP
folder, so perhaps it makes sense for LibHTTP to be the implementation
of that entire set of facilities.)
2025-11-27 14:57:29 +01:00
Timothy Flynn
0fd80a8f99 LibTextCodec+LibWeb: Move isomorphic coders to LibTextCodec
This will be used outside of LibWeb.
2025-11-27 14:57:29 +01:00
Timothy Flynn
00070455fd LibWeb: Parse the correct header list for CSP-Report-Only
Fixes a regression from a copy-paste mistake in commit:
ed27eea091

The regressed CSP tests aren't able to be imported, unfortunately. They
do not work with the file-based test-web infra.
2025-11-26 21:22:35 -05:00
Timothy Flynn
f675cfe90f LibWeb: Store HTTP methods and headers as ByteString
The spec declares these as a byte sequence, which we then implemented as
a ByteBuffer. This has become pretty awkward to deal with, as evidenced
by the plethora of `MUST(ByteBuffer::copy(...))` and `.bytes()` calls
everywhere inside Fetch. We would then treat the bytes as a string
anyways by wrapping them in StringView everywhere.

We now store these as a ByteString. This is more comfortable to deal
with, and we no longer need to continually copy underlying storage (as
ByteString is ref-counted).

This work is largely preparatory for an upcoming HTTP header refactor.
2025-11-26 09:15:06 -05:00
Timothy Flynn
ed27eea091 LibWeb: Do not copy the result of HeaderList::extract_header_list_values
There's no need to copy the Vector out of this result every time we call
it. We can move it out or access it directly.
2025-11-26 09:15:06 -05:00
Timothy Flynn
d70224ad2e LibWeb: Organize Fetch Headers.h/Headers.cpp a bit
Generally just define things in the order they are declared (will make a
change to use ByteString in this file a bit easier to follow). Also make
a couple of free functions be class methods on Header / HeaderList.
2025-11-26 09:15:06 -05:00
Tete17
fb2062a9db LibWeb: Allow CSP to block eval invocations based on TrustedTypes
This allows trusted types directives to also restrict the contents
passed to eval.
2025-11-11 09:58:34 +01:00
Luke Wilde
35c6d52d7d LibWeb/CSP: Update invalid sample assertion in violation reporting
Asserting that a sample is not provided if the resource is not Inline
is not quite valid, since Eval, TrustedTypesSink and TrustedTypesPolicy
also provide a sample.

Spec issue: https://github.com/w3c/webappsec-csp/issues/788
2025-10-31 09:08:36 +01:00
Tete17
8df173e1bd LibWeb: Add require-trusted-types-for Directive
This is meant to configure the behaviour of an injection sinks when a
string is passed.
2025-09-01 16:19:24 +01:00
Tim Ledbetter
cb1a1a5cb5 LibWeb: Replace is<T>() with as_if<T>() where possible 2025-08-25 18:45:00 +02:00
Tim Ledbetter
aadd563592 LibWeb: Replace usages of dynamic_cast with as and as_if 2025-08-22 20:26:09 +02:00
Callum Law
71b039a721 LibWeb: Use document's global object in is_base_allowed_for_document
Previously we were using the document's window - this was both contrary
to spec and causing crashes when the document did not have a window (for
instance the `temp_document` in `HTMLParser::parse_html_fragment`.

This means we no longer crash when navigating between pages on
https://rocketlabcorp.com
2025-08-16 14:19:05 +02:00
Kenneth Myhra
1228063a85 LibWeb: Enforce Integrity Policy on Fetch requests 2025-08-14 13:37:38 +01:00
Tete17
966e00fd69 LibWeb: Finish algorithm to block trusted type policy creation with CSP
This is the mechanism that should pages to determine what kind of
policies can be created on their domains mostly based around the HTTP
headers the server responds with.
2025-08-11 12:21:31 +01:00
Kenneth Myhra
70cafc558e LibWeb: Replace request's "window" with "traversable for user prompts"
User prompts are not tied to specific Windows or the client's Window.
They are tied to a traversable navigable (browser tab).
2025-08-08 11:12:53 +01:00
Luke Wilde
1d57df6e26 LibWeb/CSP: Implement the sandbox directive 2025-08-07 19:24:39 +02:00
Luke Wilde
a5e2fd2e12 LibWeb/CSP: Implement the webrtc directive 2025-08-07 19:24:39 +02:00
Luke Wilde
855e17529c LibWeb/CSP: Implement the report-to directive
This doesn't do anything by itself, the report a violation algorithm
will handle this directive itself.
2025-08-07 19:24:39 +02:00
Luke Wilde
ed0230bb93 LibWeb/CSP: Implement the report-uri directive
This doesn't do anything by itself, the report a violation algorithm
will handle this directive itself.
2025-08-07 19:24:39 +02:00
Luke Wilde
4aa355658f LibWeb/CSP: Implement the base-uri directive 2025-08-07 00:45:31 +02:00
Luke Wilde
febe4fdb46 LibWeb/CSP: Implement the frame-ancestors directive 2025-08-07 00:45:31 +02:00
Luke Wilde
f9247116b1 LibWeb/CSP: Implement the form-action directive 2025-08-07 00:45:31 +02:00
Luke Wilde
5a1de8a187 LibWeb/CSP: Implement the child-src directive 2025-07-19 17:15:21 +12:00
Luke Wilde
c5748437db LibWeb/CSP: Implement the default-src directive 2025-07-19 17:15:21 +12:00
Luke Wilde
25425f63ba LibWeb/CSP: Implement the worker-src directive 2025-07-19 17:15:21 +12:00
Luke Wilde
8e999bca62 LibWeb/CSP: Implement the style-src-attr directive 2025-07-18 11:58:04 +12:00
Luke Wilde
574b736156 LibWeb/CSP: Implement the style-src-elem directive 2025-07-18 11:58:04 +12:00
Luke Wilde
8b0b3b186f LibWeb/CSP: Implement the style-src directive 2025-07-18 11:58:04 +12:00
Tim Ledbetter
941da11ece LibWeb: Avoid accessing opaque origin port during CSP checks 2025-07-13 14:33:33 +02:00
Luke Wilde
f50f23b19f LibWeb/CSP: Implement the script-src-attr directive 2025-07-12 13:06:33 +12:00
Luke Wilde
f382bccc3d LibWeb/CSP: Implement the script-src-elem directive 2025-07-12 13:06:33 +12:00
Luke Wilde
0cff47828d LibWeb/CSP: Implement the script-src directive 2025-07-09 15:52:54 -06:00
Luke Wilde
985a481b5a LibWeb/CSP: Implement the object-src directive 2025-07-06 13:40:04 +12:00
Luke Wilde
1b12aa4d8e LibWeb/CSP: Implement the media-src directive 2025-07-06 13:40:04 +12:00
Luke Wilde
5addbcd61b LibWeb/CSP: Implement the manifest-src directive 2025-07-06 13:40:04 +12:00
Luke Wilde
002e993f68 LibWeb/CSP: Add [[nodiscard]] to result enums
This makes it so we don't have to remember to specify [[nodiscard]] on
functions that return them.
2025-07-06 13:40:04 +12:00
Luke Wilde
715061fb79 LibWeb/CSP: Implement the img-src directive 2025-07-05 21:21:44 +12:00
Luke Wilde
1689353beb LibWeb/CSP: Implement the frame-src directive 2025-07-05 21:21:44 +12:00
Luke Wilde
e899438907 LibWeb/CSP: Implement the font-src directive 2025-07-05 21:21:44 +12:00
Luke Wilde
959bb5cc18 LibWeb/CSP: Implement the connect-src directive 2025-07-05 21:21:44 +12:00
Luke Wilde
203c2a6b30 LibWeb/CSP: Use GC::Heap instead of JS::Realm for directive checks 2025-07-05 21:21:44 +12:00