Tim van der Lippe 01a29209b2 script: Implement support for X-Frame-Options (#43539) ...

We now check for this header and corresponding logic. The WPT tests
mostly pass, but rely on the `contentDocument` of the iframe to be
`null`. This is not something we did before, which means that iframes
were able to access the contents of error pages.

Instead, we now mark the document as internal with an opaque origin
according to the spec [1]. We shouldn't do this post-fact, but is
required since we first need to construct the document and enter its
realm, before we determine that it is an invalid document.

Fixes #16103

[1]:
https://html.spec.whatwg.org/multipage/document-lifecycle.html#navigate-ua-inline

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>

2026-03-23 06:14:27 +00:00

..

csp.rs

script: Fix current URL for CSP requests (#43438)

2026-03-22 11:12:22 +00:00

csppolicyviolationreport.rs

script: Set correct referrer for CSP violations (#43483)

2026-03-20 15:05:58 +00:00

cspviolationreporttask.rs

script: Pass &mut JSContext to submit_timing_data (#43479)

2026-03-20 15:31:46 +00:00

mod.rs

script: Implement support for X-Frame-Options (#43539)

2026-03-23 06:14:27 +00:00

securitypolicyviolationevent.rs

…

xframeoptions.rs

script: Implement support for X-Frame-Options (#43539)

2026-03-23 06:14:27 +00:00