From 93a436f280566e130d7ff22c0f7b33a227e00cb5 Mon Sep 17 00:00:00 2001 From: Julian Descottes Date: Fri, 17 Jul 2026 18:05:46 +0200 Subject: [PATCH] Add WebDriver BiDi CSP bypass hooks This PR updates the HTML spec to check whether CSP is bypassed via WebDriver BiDi configuration for the relevant navigable. Add an optional navigable-or-null parameter (default null) to "clone a policy container", "create a policy container from a fetch response", and "determine navigation params policy container", and skip populating/copying CSP policies when WebDriver BiDi CSP is bypassed for the given navigable. Thread the navigable through from "navigate" and "create navigation params by fetching", the two call sites that have one available. Also guard the `` processing steps the same way, since meta-injected policies bypass the fetch response path entirely. This depends on the WebDriver BiDi CSP is bypassed algorithm (https://w3c.github.io/webdriver-bidi/#webdriver-bidi-csp-is-bypassed), merged in https://github.com/w3c/webdriver-bidi/pull/1068 --- source | 57 +++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 37 insertions(+), 20 deletions(-) diff --git a/source b/source index 203f2940af2..15d5f48c537 100644 --- a/source +++ b/source @@ -4895,6 +4895,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • WebDriver BiDi file dialog opened
  • WebDriver BiDi emulated language
  • WebDriver BiDi scripting is enabled
    • +
  • WebDriver BiDi CSP is bypassed
    • @@ -18837,7 +18838,11 @@ people expect to have work and what is necessary. data-x="sandbox directive">sandbox directives from policy.

    -

  • Enforce the policy policy.

    • +

  • Let navigable be the meta element's node + navigable.

    • + +

  • If navigable is null, or WebDriver BiDi CSP is bypassed given + navigable is false, then enforce the policy policy.

    • @@ -96171,14 +96176,17 @@ interface Origin {

    To clone a policy container given a policy container - policyContainer:

    + policyContainer and an optional navigable-or-null navigable + (default null):

    1. Let clone be a new policy container.

      2. -

    2. For each policy in - policyContainer's CSP list, append a copy of policy into clone's

      If navigable is null, or WebDriver BiDi CSP is bypassed + given navigable is false, then for each + policy in policyContainer's CSP list, append a + copy of policy into clone's CSP list.

    3. Set clone's embedder @@ -96222,8 +96230,9 @@ interface Origin {

      To create a policy container from a fetch response - given a response response and an - environment-or-null environment:

      + given a response response, an + environment-or-null environment, and an optional + navigable-or-null navigable (default null):

      1. If response's URL's Origin { data-x="clone a policy container">clone of response's URL's blob URL entry's environment's policy - container.

        2. + container, given navigable.

      2. Let result be a new policy container.

        3. -

      3. Set result's CSP list to the - result of parsing a response's Content Security Policies - given response.

        4. +

      4. If navigable is null, or WebDriver BiDi CSP is bypassed + given navigable is false, then set result's CSP list to the result of parsing a response's Content Security Policies given + response.

      5. If environment is non-null, then set result's embedder policy to the result of Origin {

        To determine navigation params - policy container given a URL responseURL and four given a URL responseURL, four policy container-or-nulls historyPolicyContainer, initiatorPolicyContainer, parentPolicyContainer, and - responsePolicyContainer:

        + responsePolicyContainer, and an optional navigable-or-null + navigable (default null):

        1. @@ -96273,7 +96285,7 @@ interface Origin { in history.

        2. Return a clone of - historyPolicyContainer.

          3. + historyPolicyContainer, given navigable.

        6. @@ -96284,13 +96296,14 @@ interface Origin {

      6. Assert: parentPolicyContainer is not null.

      7. Return a clone of - parentPolicyContainer.

        8. + parentPolicyContainer, given navigable.

    4. If responseURL is local and initiatorPolicyContainer is not null, then return a clone of initiatorPolicyContainer.

      5. + container">clone of initiatorPolicyContainer, given + navigable.

    5. If responsePolicyContainer is not null, then return responsePolicyContainer.

      6. @@ -108189,7 +108202,8 @@ location.href = '#foo'; response's URL, null, sourcePolicyContainer, navigable's container document's policy container, and null.

      + data-x="concept-document-policy-container">policy container, null, and + navigable.

    6. Let finalSandboxFlags be the union of targetSnapshotParams's sandboxing @@ -110066,7 +110080,8 @@ location.href = '#foo'; data-x="she-document-state">document state's history policy container, null, navigable's container document's policy container, and null.

      7. + data-x="concept-document-policy-container">policy container, null, and + navigable.

    7. Return a new navigation params, with

      @@ -110461,8 +110476,9 @@ location.href = '#foo';

    8. Set responsePolicyContainer to the result of creating a policy - container from a fetch response given response and request's - reserved client.

      9. + container from a fetch response given response, request's + reserved client, and + navigable.

    9. Set finalSandboxFlags to the union of targetSnapshotParams's sandboxing @@ -161929,6 +161945,7 @@ INSERT INTERFACES HERE Juanmi Huertas, Jukka K. Korpela, Jules Clément-Ripoche, + Julian Descottes, Julian Reschke, Julio Lopez, 小勝　純 (Jun Kokatsu),