dyegoaurelio 453166752b Fix CSP nonce validation and violation reporting for external scripts (#40956) ...

This PR fixes two related issues with Content Security Policy (CSP)
nonce validation for external scripts:

1. Missing nonce validation for external scripts with malformed
attributes
2. Incorrect violation event reporting for blocked external resources


This makes servo closer to passing the `nonce-enforce-blocked` wpt test.

The remaining failures are blocked by required changes in the html
parser.

1. Svg script support (https://github.com/servo/html5ever/issues/118)
```html
<svg xmlns="http://www.w3.org/2000/svg">
<script attribute attribute nonce="abc">
    t.unreached_func("Duplicate attribute in SVG, no execution.")();
</script>
</svg>
```

2. Duplicate attrs check
the html parser needs to provide this flag, as mentioned on the original
commit message
(4821bc0ab0)

```html
<script attribute attribute nonce="abc">
    t.unreached_func("Duplicate attribute, no execution.")();
</script>
<script attribute attribute=<style nonce="abc">
    t.unreached_func("2# Duplicate attribute, no execution.")();
</script>

[...]

<script src="../support/nonce-should-be-blocked.js?5" attribute attribute nonce="abc"></script>
```

I've also created a PR to implement the duplicate attrs flag on
html5ever https://github.com/servo/html5ever/pull/695

Testing: doesn't fixes the aforementioned wpt test yet.
Fixes: part of #36437

---------

Signed-off-by: Dyego Aurélio <dyegoaurelio@gmail.com>

2026-02-27 13:17:33 +00:00

..

csp.rs

Fix CSP nonce validation and violation reporting for external scripts (#40956)

2026-02-27 13:17:33 +00:00

csppolicyviolationreport.rs

Fix CSP nonce validation and violation reporting for external scripts (#40956)

2026-02-27 13:17:33 +00:00

mod.rs

…

securitypolicyviolationevent.rs

…