Add support for importmap integrity #28253

yoavweiss · 2024-05-07T20:55:54Z

`339bcec`

Add support for importmap integrity
https://bugs.webkit.org/show_bug.cgi?id=272884

Reviewed by Ryosuke Niwa.

Imported ES modules can't currently have integrity checks, which means
they can't be used in sites where integrity checks are a necessity, for
security and privacy reasons.
This implements such support, by adding an "integrity" section to import
maps.

See whatwg/html#10269

* LayoutTests/TestExpectations: Ignored console logs to avoid flakiness
* LayoutTests/imported/w3c/web-platform-tests/import-maps/WEB_FEATURES.yml: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/data-driven/resources/test-helper.js:
(createTestIframe): Updated through import.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/w3c-import.log: Imports.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html: Updated to cover Request.integrity.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html: Updated to cover Request.integrity.
* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* Source/JavaScriptCore/runtime/ImportMap.cpp:
(JSC::ImportMap::resolveImportMatch): Typos and spec link.
(JSC::parseURLLikeModuleSpecifier): Typos and spec link.
(JSC::ImportMap::resolve const): Typos and spec link.
(JSC::normalizeSpecifierKey): Typos and spec link.
(JSC::sortAndNormalizeSpecifierMap): Typos and spec link.
(JSC::ImportMap::registerImportMap): Add parsing for the integrity
section.
(JSC::ImportMap::getIntegrity const): Getter for integrity based on URL.
* Source/JavaScriptCore/runtime/ImportMap.h:
* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:
(WebCore::ScriptModuleLoader::importModule): Add integrity to outgoing
requests.
(WebCore::ScriptModuleLoader::notifyFinished): Enforce integrity from
the importmap on responses, even if integrity wasn't present in the
request. Needed for static imports triggered by JSCore.
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestModuleScript): Add integrity to outgoing
requests for top-level modules, if they don't already have an integrity
attribute.

Canonical link: https://commits.webkit.org/279096@main

ac14677

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	❌ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	❌ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		❌ 🧪 jsc-armv7-tests

webkit-early-warning-system · 2024-05-07T20:55:59Z

EWS run on previous version of this PR (hash 50567d7)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2
✅ 🧪 webkitperl	❌ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	~~🧪 ios-wk2-wpt~~	❌ 🧪 mac-wk1	✅ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	❌ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	❌ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 tv-sim	⏳ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		✅ 🧪 jsc-armv7-tests

yoavweiss · 2024-05-07T21:04:50Z

Apologies for my noobness, but my git-webkit script didn't seem to do the right thing when uploading this.
Also, I still need to update the test expectations for the new tests.

webkit-early-warning-system · 2024-05-08T05:25:06Z

EWS run on previous version of this PR (hash 5314069)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
✅ 🧪 webkitpy	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
✅ 🧪 services	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		✅ 🧪 jsc-armv7-tests

webkit-early-warning-system · 2024-05-13T06:32:33Z

EWS run on previous version of this PR (hash 3491244)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	❌ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🛠 watch		~~🛠 jsc-armv7~~
	✅ 🛠 watch-sim		~~🧪 jsc-armv7-tests~~

webkit-early-warning-system · 2024-05-13T17:49:57Z

EWS run on previous version of this PR (hash f61a244)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	❌ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	❌ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	❌ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	❌ 🧪 mac-AS-debug-wk2	~~🧪 gtk-wk2~~
	✅ 🛠 tv-sim	❌ 🧪 mac-wk2-stress	⏳ 🧪 api-gtk
	✅ 🛠 watch		~~🛠 jsc-armv7~~
	✅ 🛠 watch-sim		~~🧪 jsc-armv7-tests~~

webkit-early-warning-system · 2024-05-13T20:33:22Z

EWS run on previous version of this PR (hash 50dc1bb)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	~~🧪 api-gtk~~
	✅ 🛠 watch		~~🛠 jsc-armv7~~
	✅ 🛠 watch-sim		~~🧪 jsc-armv7-tests~~

webkit-early-warning-system · 2024-05-14T03:51:01Z

EWS run on previous version of this PR (hash 0e261b9)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	~~🧪 api-mac~~	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	~~🧪 gtk-wk2~~
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	⏳ 🧪 api-gtk
	✅ 🛠 watch		~~🛠 jsc-armv7~~
	✅ 🛠 watch-sim		~~🧪 jsc-armv7-tests~~

webkit-early-warning-system · 2024-05-14T05:26:49Z

EWS run on previous version of this PR (hash 41d987a)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	❌ 🧪 api-gtk
	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		✅ 🧪 jsc-armv7-tests

Source/JavaScriptCore/runtime/ImportMap.cpp

yoavweiss · 2024-05-14T06:17:51Z

LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt

+FAIL Modulepreload was not loaded as its integrity check was not ignored assert_unreached: Should have rejected: undefined Reached unreachable code
+PASS Modulepreload was loaded as its correct integrity attribute was not ignored
+PASS Modulepreload was loaded as its empty integrity attribute was not ignored
+FAIL Modulepreload was not loaded as its bad integrity attribute was not ignored assert_unreached: Should have rejected: undefined Reached unreachable code


This fails because module preload integrity is not supported.

yoavweiss · 2024-05-14T06:18:47Z

...web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt

@@ -29,6 +29,10 @@ PASS Script load (url:https://localhost:9443/service-workers/service-worker/reso
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test27)
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test28)
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test29)
+PASS Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_module)
+FAIL Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_modulepreload) assert_equals: integrity of Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_modulepreload) must be sha384-foobar. expected "sha384-foobar" but got ""


This fails because of modulepreload integrity is not supported in this PR.

yoavweiss · 2024-05-14T06:19:43Z

...web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt

@@ -29,6 +29,10 @@ PASS Script load (url:https://localhost:9443/service-workers/service-worker/reso
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test27)
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test28)
 PASS Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test29)
+PASS Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_module)
+FAIL Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_modulepreload) assert_equals: integrity of Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_modulepreload) must be sha384-foobar. expected "sha384-foobar" but got ""
+FAIL Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_moduleimport) assert_equals: integrity of Module Script load (url:https://localhost:9443/service-workers/service-worker/resources/sample?test_moduleimport) must be sha384-foobar. expected "sha384-foobar" but got ""


This fails because of the way I implemented static import integrity (only on the response side)

yoavweiss · 2024-05-14T06:20:25Z

...ted/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html

@@ -90,7 +90,67 @@
      destination: 'script',
      message: `Script load (url:${actual_url})`
    };
-  frame.contentWindow.load_script_with_integrity(actual_url, integrity);


This is a manual import, as importing the entire service-workers directory introduced too much unrelated noise

yoavweiss · 2024-05-14T06:21:55Z

Source/WebCore/bindings/js/ScriptModuleLoader.cpp

-                    rejectWithFetchError(*m_context, WTFMove(promise), ExceptionCode::TypeError, "Cannot load script due to integrity mismatch"_s);
-                    return;
-                }
+        String integrity = downcast<Document>(*m_context).globalObject()->importMap().getIntegrity(sourceURL);


This enforces integrity checks on the response even in cases where the integrity value is not propagated through the request (static imports).

yoavweiss · 2024-05-14T06:23:17Z

There are still a few open questions (as comments), but I'd love an initial review of the approach.

...Tests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html

LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html

...orm-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html

webkit-early-warning-system · 2024-05-17T14:56:00Z

EWS run on previous version of this PR (hash c710e8d)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
⏳ 🧪 style	🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
⏳ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	🧪 wpe-wk2	✅ 🧪 wincairo-tests
⏳ 🧪 webkitperl	✅ 🧪 ios-wk2	🧪 api-mac	✅ 🧪 api-wpe
	🧪 ios-wk2-wpt	🧪 mac-wk1	✅ 🛠 wpe-cairo
🛠 🧪 jsc	🧪 api-ios	🧪 mac-wk2	✅ 🛠 gtk
🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	🧪 gtk-wk2
⏳ 🧪 services	🛠 tv-sim	🧪 mac-wk2-stress	🧪 api-gtk
	🛠 watch		✅ 🛠 jsc-armv7
	⏳ 🛠 watch-sim		✅ 🧪 jsc-armv7-tests

LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html

...Tests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html

webkit-early-warning-system · 2024-05-18T19:29:24Z

EWS run on previous version of this PR (hash f11ae62)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	❌ 🧪 ios-wk2	❌ 🧪 api-mac	✅ 🧪 api-wpe
✅ 🧪 webkitpy	❌ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
✅ 🧪 services	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	❌ 🧪 api-gtk
	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		✅ 🧪 jsc-armv7-tests

webkit-early-warning-system · 2024-05-21T06:31:53Z

EWS run on previous version of this PR (hash b224e85)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 wincairo~~
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	⏳ 🧪 wpe-wk2	~~🧪 wincairo-tests~~
✅ 🧪 webkitperl	⏳ 🧪 ios-wk2	✅ 🧪 api-mac	~~🧪 api-wpe~~
✅ 🧪 webkitpy	⏳ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
~~🛠 🧪 jsc~~	⏳ 🧪 api-ios	~~🧪 mac-wk2~~	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	~~🧪 mac-AS-debug-wk2~~	⏳ 🧪 gtk-wk2
✅ 🧪 services	~~🛠 tv-sim~~	✅ 🧪 mac-wk2-stress	⏳ 🧪 api-gtk
	~~🛠 watch~~		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		⏳ 🧪 jsc-armv7-tests

Source/JavaScriptCore/runtime/ImportMap.h

Source/JavaScriptCore/runtime/ImportMap.cpp

Source/WebCore/dom/ScriptElement.cpp

yoavweiss

Thanks for reviewing!

Source/JavaScriptCore/runtime/ImportMap.cpp

Source/JavaScriptCore/runtime/ImportMap.h

Source/WebCore/dom/ScriptElement.cpp

webkit-early-warning-system · 2024-05-21T07:22:21Z

EWS run on current version of this PR (hash ac14677)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	❌ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	❌ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 watch		✅ 🛠 jsc-armv7
	✅ 🛠 watch-sim		❌ 🧪 jsc-armv7-tests

marcoscaceres

Non-reviewer r+ on the tests, with that additional one I suggested.

marcoscaceres · 2024-05-21T11:53:02Z

@yoavweiss, ping me if/when you need me to add it to the merge queue.

https://bugs.webkit.org/show_bug.cgi?id=272884 Reviewed by Ryosuke Niwa. Imported ES modules can't currently have integrity checks, which means they can't be used in sites where integrity checks are a necessity, for security and privacy reasons. This implements such support, by adding an "integrity" section to import maps. See whatwg/html#10269 * LayoutTests/TestExpectations: Ignored console logs to avoid flakiness * LayoutTests/imported/w3c/web-platform-tests/import-maps/WEB_FEATURES.yml: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/data-driven/resources/test-helper.js: (createTestIframe): Updated through import. * LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity.html: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity.html: Added. * LayoutTests/imported/w3c/web-platform-tests/import-maps/w3c-import.log: Imports. * LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated. * LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html: Updated to cover Request.integrity. * LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html: Updated to cover Request.integrity. * LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated. * Source/JavaScriptCore/runtime/ImportMap.cpp: (JSC::ImportMap::resolveImportMatch): Typos and spec link. (JSC::parseURLLikeModuleSpecifier): Typos and spec link. (JSC::ImportMap::resolve const): Typos and spec link. (JSC::normalizeSpecifierKey): Typos and spec link. (JSC::sortAndNormalizeSpecifierMap): Typos and spec link. (JSC::ImportMap::registerImportMap): Add parsing for the integrity section. (JSC::ImportMap::getIntegrity const): Getter for integrity based on URL. * Source/JavaScriptCore/runtime/ImportMap.h: * Source/WebCore/bindings/js/ScriptModuleLoader.cpp: (WebCore::ScriptModuleLoader::importModule): Add integrity to outgoing requests. (WebCore::ScriptModuleLoader::notifyFinished): Enforce integrity from the importmap on responses, even if integrity wasn't present in the request. Needed for static imports triggered by JSCore. * Source/WebCore/dom/ScriptElement.cpp: (WebCore::ScriptElement::requestModuleScript): Add integrity to outgoing requests for top-level modules, if they don't already have an integrity attribute. Canonical link: https://commits.webkit.org/279096@main

webkit-commit-queue · 2024-05-22T01:56:16Z

Committed 279096@main (339bcec): https://commits.webkit.org/279096@main

Reviewed commits have been landed. Closing PR #28253 and removing active labels.

yoavweiss force-pushed the importmap_integrity branch from f7bd01e to 50567d7 Compare May 7, 2024 20:55

yoavweiss requested a review from a team as a code owner May 7, 2024 20:55

Ahmad-S792 assigned yoavweiss May 7, 2024

Ahmad-S792 added the WebCore Misc. For miscellaneous bugs in the WebCore framework (and not JavaScriptCore or WebKit). label May 7, 2024

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 7, 2024

yoavweiss changed the title ~~Update importmap tests and spec references~~ Add test expectations May 8, 2024

yoavweiss force-pushed the importmap_integrity branch from 50567d7 to 5314069 Compare May 8, 2024 05:25

yoavweiss changed the title ~~Add test expectations~~ Update importmap tests and spec references May 8, 2024

yoavweiss marked this pull request as draft May 13, 2024 05:32

yoavweiss changed the title ~~Update importmap tests and spec references~~ Add support for importmap integrity May 13, 2024

yoavweiss force-pushed the importmap_integrity branch from 5314069 to 3491244 Compare May 13, 2024 06:32

yoavweiss force-pushed the importmap_integrity branch from 3491244 to f61a244 Compare May 13, 2024 17:49

yoavweiss force-pushed the importmap_integrity branch from f61a244 to 50dc1bb Compare May 13, 2024 20:30

yoavweiss force-pushed the importmap_integrity branch from 50dc1bb to 0e261b9 Compare May 14, 2024 03:50

yoavweiss force-pushed the importmap_integrity branch from 0e261b9 to 41d987a Compare May 14, 2024 05:26

yoavweiss commented May 14, 2024

View reviewed changes

yoavweiss marked this pull request as ready for review May 14, 2024 06:22

yoavweiss requested review from cdumez and rniwa as code owners May 14, 2024 06:22

marcoscaceres reviewed May 14, 2024

View reviewed changes

...Tests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html Outdated Show resolved Hide resolved

marcoscaceres reviewed May 14, 2024

View reviewed changes

LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html Show resolved Hide resolved

marcoscaceres reviewed May 17, 2024

View reviewed changes

...orm-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html Outdated Show resolved Hide resolved

yoavweiss force-pushed the importmap_integrity branch from b9abcca to c710e8d Compare May 17, 2024 08:44

marcoscaceres reviewed May 18, 2024

View reviewed changes

LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html Outdated Show resolved Hide resolved

marcoscaceres reviewed May 18, 2024

View reviewed changes

LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html Outdated Show resolved Hide resolved

marcoscaceres reviewed May 18, 2024

View reviewed changes

LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html Outdated Show resolved Hide resolved

marcoscaceres reviewed May 18, 2024

View reviewed changes

...Tests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html Show resolved Hide resolved

yoavweiss force-pushed the importmap_integrity branch from c710e8d to f11ae62 Compare May 18, 2024 19:29

yoavweiss force-pushed the importmap_integrity branch from f11ae62 to b224e85 Compare May 21, 2024 06:31

rniwa reviewed May 21, 2024

View reviewed changes

Source/JavaScriptCore/runtime/ImportMap.h Outdated Show resolved Hide resolved

rniwa reviewed May 21, 2024

View reviewed changes

Source/JavaScriptCore/runtime/ImportMap.h Outdated Show resolved Hide resolved

rniwa reviewed May 21, 2024

View reviewed changes

Source/JavaScriptCore/runtime/ImportMap.cpp Outdated Show resolved Hide resolved

rniwa reviewed May 21, 2024

View reviewed changes

Source/WebCore/dom/ScriptElement.cpp Outdated Show resolved Hide resolved

yoavweiss commented May 21, 2024

View reviewed changes

yoavweiss force-pushed the importmap_integrity branch from b224e85 to ac14677 Compare May 21, 2024 07:22

rniwa approved these changes May 21, 2024

View reviewed changes

marcoscaceres approved these changes May 21, 2024

View reviewed changes

marcoscaceres added merge-queue Applied to send a pull request to merge-queue and removed merging-blocked Applied to prevent a change from being merged labels May 22, 2024

webkit-commit-queue force-pushed the importmap_integrity branch from ac14677 to 339bcec Compare May 22, 2024 01:56

webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label May 22, 2024

webkit-commit-queue merged commit 339bcec into WebKit:main May 22, 2024

This was referenced May 22, 2024

Import map integrity tests - WebKit improvements web-platform-tests/wpt#46423

Merged

Importmap integrity section mdn/content#33712

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for importmap integrity #28253

Add support for importmap integrity #28253

yoavweiss commented May 7, 2024 •

edited by webkit-early-warning-system

webkit-early-warning-system commented May 7, 2024 •

edited

yoavweiss commented May 7, 2024

webkit-early-warning-system commented May 8, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 14, 2024 •

edited

webkit-early-warning-system commented May 14, 2024 •

edited

yoavweiss May 14, 2024

yoavweiss May 14, 2024

yoavweiss May 14, 2024

yoavweiss May 14, 2024

yoavweiss May 14, 2024

yoavweiss commented May 14, 2024

webkit-early-warning-system commented May 17, 2024 •

edited

webkit-early-warning-system commented May 18, 2024 •

edited

webkit-early-warning-system commented May 21, 2024 •

edited

yoavweiss left a comment

webkit-early-warning-system commented May 21, 2024 •

edited

marcoscaceres left a comment

marcoscaceres commented May 21, 2024

webkit-commit-queue commented May 22, 2024

Add support for importmap integrity #28253

Add support for importmap integrity #28253

Conversation

yoavweiss commented May 7, 2024 • edited by webkit-early-warning-system

339bcec

webkit-early-warning-system commented May 7, 2024 • edited

yoavweiss commented May 7, 2024

webkit-early-warning-system commented May 8, 2024 • edited

webkit-early-warning-system commented May 13, 2024 • edited

webkit-early-warning-system commented May 13, 2024 • edited

webkit-early-warning-system commented May 13, 2024 • edited

webkit-early-warning-system commented May 14, 2024 • edited

webkit-early-warning-system commented May 14, 2024 • edited

yoavweiss May 14, 2024

Choose a reason for hiding this comment

yoavweiss May 14, 2024

Choose a reason for hiding this comment

yoavweiss May 14, 2024

Choose a reason for hiding this comment

yoavweiss May 14, 2024

Choose a reason for hiding this comment

yoavweiss May 14, 2024

Choose a reason for hiding this comment

yoavweiss commented May 14, 2024

webkit-early-warning-system commented May 17, 2024 • edited

webkit-early-warning-system commented May 18, 2024 • edited

webkit-early-warning-system commented May 21, 2024 • edited

yoavweiss left a comment

Choose a reason for hiding this comment

webkit-early-warning-system commented May 21, 2024 • edited

marcoscaceres left a comment

Choose a reason for hiding this comment

marcoscaceres commented May 21, 2024

webkit-commit-queue commented May 22, 2024

yoavweiss commented May 7, 2024 •

edited by webkit-early-warning-system

`339bcec`

webkit-early-warning-system commented May 7, 2024 •

edited

webkit-early-warning-system commented May 8, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 13, 2024 •

edited

webkit-early-warning-system commented May 14, 2024 •

edited

webkit-early-warning-system commented May 14, 2024 •

edited

webkit-early-warning-system commented May 17, 2024 •

edited

webkit-early-warning-system commented May 18, 2024 •

edited

webkit-early-warning-system commented May 21, 2024 •

edited

webkit-early-warning-system commented May 21, 2024 •

edited