Skip to content

Commit

Permalink
[CSP] Make SVGElement to handle "nonce" the same way as HTMLElement.
Browse files Browse the repository at this point in the history
According to CSP, nonce are handled the same way for both HTMLElement
and SVGElement.

Both are setting the nonce when the Element is inserted, but only the
HTMLElement was supporting "modifying" a nonce.

It looks like a bug in Chrome found by annevk@:
web-platform-tests/wpt#21853

This patch fixes the issue. It was meant to fix the WPT test:
- content-security-policy/nonce-hiding/nonces.html

But it turns out it is also fixing two more tests
- content-security-policy/nonce-hiding/svgscript-nonces-hidden.html
- content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta-sub.html

Bug: 1053496
Change-Id: I872cae74817bff2f5f910dcd7864fc97426c49cf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2075340
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746774}
  • Loading branch information
ArthurSonzogni authored and Commit Bot committed Mar 4, 2020
1 parent 722fa41 commit c70f383
Show file tree
Hide file tree
Showing 4 changed files with 6 additions and 39 deletions.
6 changes: 6 additions & 0 deletions third_party/blink/renderer/core/svg/svg_element.cc
Original file line number Diff line number Diff line change
Expand Up @@ -620,6 +620,12 @@ void SVGElement::ParseAttribute(const AttributeModificationParams& params) {
return;
}

// SVGElement and HTMLElement are handling "nonce" the same way.
if (params.name == html_names::kNonceAttr) {
if (params.new_value != g_empty_atom)
setNonce(params.new_value);
}

const AtomicString& event_name =
HTMLElement::EventNameForAttributeName(params.name);
if (!event_name.IsNull()) {
Expand Down

This file was deleted.

This file was deleted.

This file was deleted.

0 comments on commit c70f383

Please sign in to comment.