Skip to content

Add support for importmap integrity#28253

Merged
webkit-commit-queue merged 1 commit intoWebKit:mainfrom
yoavweiss:importmap_integrity
May 22, 2024
Merged

Add support for importmap integrity#28253
webkit-commit-queue merged 1 commit intoWebKit:mainfrom
yoavweiss:importmap_integrity

Conversation

@yoavweiss
Copy link
Copy Markdown
Contributor

@yoavweiss yoavweiss commented May 7, 2024 •
edited by webkit-early-warning-system
Loading

339bcec

Add support for importmap integrity
https://bugs.webkit.org/show_bug.cgi?id=272884

Reviewed by Ryosuke Niwa.

Imported ES modules can't currently have integrity checks, which means
they can't be used in sites where integrity checks are a necessity, for
security and privacy reasons.
This implements such support, by adding an "integrity" section to import
maps.

See whatwg/html#10269

* LayoutTests/TestExpectations: Ignored console logs to avoid flakiness
* LayoutTests/imported/w3c/web-platform-tests/import-maps/WEB_FEATURES.yml: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/data-driven/resources/test-helper.js:
(createTestIframe): Updated through import.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/w3c-import.log: Imports.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html: Updated to cover Request.integrity.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html: Updated to cover Request.integrity.
* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* Source/JavaScriptCore/runtime/ImportMap.cpp:
(JSC::ImportMap::resolveImportMatch): Typos and spec link.
(JSC::parseURLLikeModuleSpecifier): Typos and spec link.
(JSC::ImportMap::resolve const): Typos and spec link.
(JSC::normalizeSpecifierKey): Typos and spec link.
(JSC::sortAndNormalizeSpecifierMap): Typos and spec link.
(JSC::ImportMap::registerImportMap): Add parsing for the integrity
section.
(JSC::ImportMap::getIntegrity const): Getter for integrity based on URL.
* Source/JavaScriptCore/runtime/ImportMap.h:
* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:
(WebCore::ScriptModuleLoader::importModule): Add integrity to outgoing
requests.
(WebCore::ScriptModuleLoader::notifyFinished): Enforce integrity from
the importmap on responses, even if integrity wasn't present in the
request. Needed for static imports triggered by JSCore.
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestModuleScript): Add integrity to outgoing
requests for top-level modules, if they don't already have an integrity
attribute.

Canonical link: https://commits.webkit.org/279096@main

ac14677

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ✅ 🧪 wincairo-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ❌ 🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from f7bd01e to 50567d7 Compare May 7, 2024 20:55
@yoavweiss yoavweiss requested a review from a team as a code owner May 7, 2024 20:55
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 7, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 50567d7)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
  🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ✅ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 tv-sim ⏳ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

@yoavweiss
Copy link
Copy Markdown
Contributor Author

yoavweiss commented May 7, 2024

Apologies for my noobness, but my git-webkit script didn't seem to do the right thing when uploading this.
Also, I still need to update the test expectations for the new tests.

@Ahmad-S792 Ahmad-S792 added the WebCore Misc. For miscellaneous bugs in the WebCore framework (and not JavaScriptCore or WebKit). label May 7, 2024
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 7, 2024
@yoavweiss yoavweiss changed the title Update importmap tests and spec references Add test expectations May 8, 2024
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 8, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 5314069)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 webkitpy ✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🧪 services ✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from 50567d7 to 5314069 Compare May 8, 2024 05:25
@yoavweiss yoavweiss changed the title Add test expectations Update importmap tests and spec references May 8, 2024
@yoavweiss yoavweiss marked this pull request as draft May 13, 2024 05:32
@yoavweiss yoavweiss changed the title Update importmap tests and spec references Add support for importmap integrity May 13, 2024
@yoavweiss yoavweiss force-pushed the importmap_integrity branch from 5314069 to 3491244 Compare May 13, 2024 06:32
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 13, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 3491244)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ❌ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 watch   🛠 jsc-armv7
✅ 🛠 watch-sim   🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from 3491244 to f61a244 Compare May 13, 2024 17:49
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 13, 2024 •
edited
Loading

EWS run on previous version of this PR (hash f61a244)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ❌ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug   🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ❌ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ❌ 🧪 mac-AS-debug-wk2   🧪 gtk-wk2
✅ 🛠 tv-sim ❌ 🧪 mac-wk2-stress ⏳ 🧪 api-gtk
✅ 🛠 watch   🛠 jsc-armv7
✅ 🛠 watch-sim   🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from f61a244 to 50dc1bb Compare May 13, 2024 20:30
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 13, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 50dc1bb)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress   🧪 api-gtk
✅ 🛠 watch   🛠 jsc-armv7
✅ 🛠 watch-sim   🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from 50dc1bb to 0e261b9 Compare May 14, 2024 03:50
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 14, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 0e261b9)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug   🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2   🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc   🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2   🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ⏳ 🧪 api-gtk
✅ 🛠 watch   🛠 jsc-armv7
✅ 🛠 watch-sim   🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from 0e261b9 to 41d987a Compare May 14, 2024 05:26
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 14, 2024 •
edited
Loading

EWS run on previous version of this PR (hash 41d987a)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ⏳ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

yoavweiss
yoavweiss commented May 14, 2024
View reviewed changes
LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt Outdated
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss May 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fails because module preload integrity is not supported.

...web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt Outdated
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss May 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fails because of modulepreload integrity is not supported in this PR.

...web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt Outdated
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss May 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fails because of the way I implemented static import integrity (only on the response side)

...ted/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html Outdated
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss May 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a manual import, as importing the entire service-workers directory introduced too much unrelated noise

Source/WebCore/bindings/js/ScriptModuleLoader.cpp Outdated
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss May 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This enforces integrity checks on the response even in cases where the integrity value is not propagated through the request (static imports).

@yoavweiss yoavweiss marked this pull request as ready for review May 14, 2024 06:22
@yoavweiss yoavweiss requested review from cdumez and rniwa as code owners May 14, 2024 06:22
@yoavweiss
Copy link
Copy Markdown
Contributor Author

yoavweiss commented May 14, 2024

There are still a few open questions (as comments), but I'd love an initial review of the approach.

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from b9abcca to c710e8d Compare May 17, 2024 08:44
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 17, 2024 •
edited
Loading

EWS run on previous version of this PR (hash c710e8d)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
⏳ 🧪 style loading 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
⏳ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug loading-orange 🧪 wpe-wk2 ✅ 🧪 wincairo-tests
⏳ 🧪 webkitperl ✅ 🧪 ios-wk2 loading 🧪 api-mac ✅ 🧪 api-wpe
loading 🧪 ios-wk2-wpt loading-orange 🧪 mac-wk1 ✅ 🛠 wpe-cairo
loading 🛠 🧪 jsc loading 🧪 api-ios loading 🧪 mac-wk2 ✅ 🛠 gtk
loading 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 loading 🧪 gtk-wk2
⏳ 🧪 services loading 🛠 tv-sim loading 🧪 mac-wk2-stress loading-orange 🧪 api-gtk
loading 🛠 watch ✅ 🛠 jsc-armv7
⏳ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from c710e8d to f11ae62 Compare May 18, 2024 19:29
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 18, 2024 •
edited
Loading

EWS run on previous version of this PR (hash f11ae62)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ✅ 🧪 wincairo-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 webkitpy ❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🧪 services ✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from f11ae62 to b224e85 Compare May 21, 2024 06:31
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 21, 2024 •
edited
Loading

EWS run on previous version of this PR (hash b224e85)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe   🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ⏳ 🧪 wpe-wk2   🧪 wincairo-tests
✅ 🧪 webkitperl ⏳ 🧪 ios-wk2 ✅ 🧪 api-mac   🧪 api-wpe
✅ 🧪 webkitpy ⏳ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
  🛠 🧪 jsc ⏳ 🧪 api-ios   🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv   🧪 mac-AS-debug-wk2 ⏳ 🧪 gtk-wk2
✅ 🧪 services   🛠 tv-sim ✅ 🧪 mac-wk2-stress ⏳ 🧪 api-gtk
  🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ⏳ 🧪 jsc-armv7-tests

rniwa
rniwa reviewed May 21, 2024
View reviewed changes
rniwa
rniwa reviewed May 21, 2024
View reviewed changes
rniwa
rniwa reviewed May 21, 2024
View reviewed changes
rniwa
rniwa reviewed May 21, 2024
View reviewed changes
yoavweiss
yoavweiss commented May 21, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor Author

@yoavweiss yoavweiss left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for reviewing!

@yoavweiss yoavweiss force-pushed the importmap_integrity branch from b224e85 to ac14677 Compare May 21, 2024 07:22
@webkit-early-warning-system
Copy link
Copy Markdown
Collaborator

webkit-early-warning-system commented May 21, 2024 •
edited
Loading

EWS run on current version of this PR (hash ac14677)

Details

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ✅ 🧪 wincairo-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 watch-sim ❌ 🧪 jsc-armv7-tests

marcoscaceres
marcoscaceres approved these changes May 21, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@marcoscaceres marcoscaceres left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-reviewer r+ on the tests, with that additional one I suggested.

@marcoscaceres
Copy link
Copy Markdown
Contributor

marcoscaceres commented May 21, 2024

@yoavweiss, ping me if/when you need me to add it to the merge queue.

@marcoscaceres marcoscaceres added merge-queue Applied to send a pull request to merge-queue and removed merging-blocked Applied to prevent a change from being merged labels May 22, 2024
@yoavweiss @marcoscaceres
Add support for importmap integrity
339bcec 
https://bugs.webkit.org/show_bug.cgi?id=272884

Reviewed by Ryosuke Niwa.

Imported ES modules can't currently have integrity checks, which means
they can't be used in sites where integrity checks are a necessity, for
security and privacy reasons.
This implements such support, by adding an "integrity" section to import
maps.

See whatwg/html#10269

* LayoutTests/TestExpectations: Ignored console logs to avoid flakiness
* LayoutTests/imported/w3c/web-platform-tests/import-maps/WEB_FEATURES.yml: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/data-driven/resources/test-helper.js:
(createTestIframe): Updated through import.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/dynamic-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity-valid.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/no-referencing-script-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/nonimport-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/static-integrity.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/import-maps/w3c-import.log: Imports.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https.html: Updated to cover Request.integrity.
* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-request-resources-iframe.https.html: Updated to cover Request.integrity.
* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-resources.https-expected.txt: Updated.
* Source/JavaScriptCore/runtime/ImportMap.cpp:
(JSC::ImportMap::resolveImportMatch): Typos and spec link.
(JSC::parseURLLikeModuleSpecifier): Typos and spec link.
(JSC::ImportMap::resolve const): Typos and spec link.
(JSC::normalizeSpecifierKey): Typos and spec link.
(JSC::sortAndNormalizeSpecifierMap): Typos and spec link.
(JSC::ImportMap::registerImportMap): Add parsing for the integrity
section.
(JSC::ImportMap::getIntegrity const): Getter for integrity based on URL.
* Source/JavaScriptCore/runtime/ImportMap.h:
* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:
(WebCore::ScriptModuleLoader::importModule): Add integrity to outgoing
requests.
(WebCore::ScriptModuleLoader::notifyFinished): Enforce integrity from
the importmap on responses, even if integrity wasn't present in the
request. Needed for static imports triggered by JSCore.
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestModuleScript): Add integrity to outgoing
requests for top-level modules, if they don't already have an integrity
attribute.

Canonical link: https://commits.webkit.org/279096@main
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

webkit-commit-queue commented May 22, 2024

Committed 279096@main (339bcec): https://commits.webkit.org/279096@main

Reviewed commits have been landed. Closing PR #28253 and removing active labels.

@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label May 22, 2024
@webkit-commit-queue webkit-commit-queue merged commit 339bcec into WebKit:main May 22, 2024
This was referenced May 22, 2024
Merged
Merged
@yoavweiss yoavweiss deleted the importmap_integrity branch June 4, 2024 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rniwa rniwa rniwa approved these changes

@marcoscaceres marcoscaceres marcoscaceres approved these changes

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

Assignees

@yoavweiss yoavweiss

Labels

WebCore Misc. For miscellaneous bugs in the WebCore framework (and not JavaScriptCore or WebKit).

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@yoavweiss @webkit-early-warning-system @marcoscaceres @webkit-commit-queue @rniwa @Ahmad-S792 @webkit-ews-buildbot