dyegoaurelio 453166752b Fix CSP nonce validation and violation reporting for external scripts (#40956) ...

This PR fixes two related issues with Content Security Policy (CSP)
nonce validation for external scripts:

1. Missing nonce validation for external scripts with malformed
attributes
2. Incorrect violation event reporting for blocked external resources


This makes servo closer to passing the `nonce-enforce-blocked` wpt test.

The remaining failures are blocked by required changes in the html
parser.

1. Svg script support (https://github.com/servo/html5ever/issues/118)
```html
<svg xmlns="http://www.w3.org/2000/svg">
<script attribute attribute nonce="abc">
    t.unreached_func("Duplicate attribute in SVG, no execution.")();
</script>
</svg>
```

2. Duplicate attrs check
the html parser needs to provide this flag, as mentioned on the original
commit message
(4821bc0ab0)

```html
<script attribute attribute nonce="abc">
    t.unreached_func("Duplicate attribute, no execution.")();
</script>
<script attribute attribute=<style nonce="abc">
    t.unreached_func("2# Duplicate attribute, no execution.")();
</script>

[...]

<script src="../support/nonce-should-be-blocked.js?5" attribute attribute nonce="abc"></script>
```

I've also created a PR to implement the duplicate attrs flag on
html5ever https://github.com/servo/html5ever/pull/695

Testing: doesn't fixes the aforementioned wpt test yet.
Fixes: part of #36437

---------

Signed-off-by: Dyego Aurélio <dyegoaurelio@gmail.com>

2026-02-27 13:17:33 +00:00

..

htmlanchorelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlareaelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlaudioelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlbaseelement.rs

script: Implement base-uri CSP check (#42272)

2026-02-01 17:03:23 +00:00

htmlbodyelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlbrelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlbuttonelement.rs

script: Add an initial command and commandfor attribute implementation (#41237)

2026-02-25 21:40:39 +00:00

htmlcanvaselement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlcollection.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldataelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldatalistelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldetailselement.rs

script: Add support for :open pseudo-class (#42195)

2026-01-29 17:08:51 +00:00

htmldialogelement.rs

script: Add an initial command and commandfor attribute implementation (#41237)

2026-02-25 21:40:39 +00:00

htmldirectoryelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldivelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldlistelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmldocument.rs

…

htmlelement.rs

script: Turn scrollParent into a function and change wpt tests (#42689)

2026-02-17 21:21:12 +00:00

htmlembedelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlfieldsetelement.rs

Script: Use &mut JSContext in CheckValidity and ReportValidity Methods (#42820)

2026-02-25 10:34:21 +00:00

htmlfontelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlformcontrolscollection.rs

Turn all commented links before functions into doccomments (#40331)

2025-11-01 05:32:45 +00:00

htmlformelement.rs

Script: Use &mut JSContext in CheckValidity and ReportValidity Methods (#42820)

2026-02-25 10:34:21 +00:00

htmlframeelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlframesetelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlheadelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlheadingelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlhrelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlhtmlelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlhyperlinkelementutils.rs

script: Have HyperlinkElementTraits::update_href take a &ServoUrl (#39396)

2025-09-20 08:40:36 +00:00

htmliframeelement.rs

script: Propagate &mut JSContext inside evaluate_js_on_global (#42846)

2026-02-27 11:49:44 +00:00

htmlimageelement.rs

script: Pass down &mut JSContext in servoparser and event loop. (#42635)

2026-02-25 07:14:23 +00:00

htmlinputelement.rs

Revert "script: Fire select events for user input selections (#42806)" (#42876)

2026-02-26 11:52:36 +00:00

htmllabelelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmllegendelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmllielement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmllinkelement.rs

Fix CSP nonce validation and violation reporting for external scripts (#40956)

2026-02-27 13:17:33 +00:00

htmlmapelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlmediaelement.rs

script: Pass down &mut JSContext in servoparser and event loop. (#42635)

2026-02-25 07:14:23 +00:00

htmlmenuelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlmetaelement.rs

Rename compositing and compositing_traits to paint and paint_api (#42066)

2026-01-24 09:17:35 +00:00

htmlmeterelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlmodelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlobjectelement.rs

Script: Use &mut JSContext in CheckValidity and ReportValidity Methods (#42820)

2026-02-25 10:34:21 +00:00

htmlolistelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmloptgroupelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmloptionelement.rs

Implement html5ever hooks for customizable <select> elements (#42036)

2026-01-22 13:34:12 +00:00

htmloptionscollection.rs

script: Do not consider a node an ancestor of itself in Node::is_ancestor_of (#42263)

2026-01-31 10:22:23 +00:00

htmloutputelement.rs

Script: Use &mut JSContext in CheckValidity and ReportValidity Methods (#42820)

2026-02-25 10:34:21 +00:00

htmlparagraphelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlparamelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlpictureelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlpreelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlprogresselement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlquoteelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlscriptelement.rs

Fix CSP nonce validation and violation reporting for external scripts (#40956)

2026-02-27 13:17:33 +00:00

htmlselectelement.rs

Script: Use &mut JSContext in CheckValidity and ReportValidity Methods (#42820)

2026-02-25 10:34:21 +00:00

htmlslotelement.rs

script: add force option for assign-slottables for a tree (#42250)

2026-02-02 07:25:13 +00:00

htmlsourceelement.rs

script: Pass down &mut JSContext in servoparser and event loop. (#42635)

2026-02-25 07:14:23 +00:00

htmlspanelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlstyleelement.rs

script: Support blocking attribute for style and link elements (#42096)

2026-01-26 09:12:38 +00:00

htmltablecaptionelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltablecellelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltablecolelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltableelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltablerowelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltablesectionelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltemplateelement.rs

script: Set host for template content (#42276)

2026-02-02 08:25:54 +00:00

htmltextareaelement.rs

Revert "script: Fire select events for user input selections (#42806)" (#42876)

2026-02-26 11:52:36 +00:00

htmltimeelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltitleelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmltrackelement.rs

script/dom/: Change some #[allow]s to #[expect]s (#40454)

2025-11-06 11:06:03 +00:00

htmlulistelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlunknownelement.rs

Replace allow(crown::unrooted_must_root) with expect(crown::unrooted_must_root) (#41815)

2026-01-10 08:05:49 +00:00

htmlvideoelement.rs

script: Pass down &mut JSContext in servoparser and event loop. (#42635)

2026-02-25 07:14:23 +00:00

mod.rs

script/dom/: Change some #[allow]s to #[expect]s (#40454)

2025-11-06 11:06:03 +00:00