Discharge7443/brave-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[csp]: Remove option to disable trusted types (#36805)

Browse Source
This commit is contained in:
Jay Harris
2026-05-28 06:37:24 +01:00
committed by GitHub
parent 07941b18b6
commit 859131ea58
7 changed files with 13 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browser/ui/webui/brave_webui_source.cc
+7 -22
View File
@@ -49,26 +49,13 @@ content::WebUIDataSource* CreateWebUIDataSource(
content::WebUI* web_ui,
std::string_view name,
base::span<const webui::ResourcePath> resource_paths,
int html_resource_id,
bool disable_trusted_types_csp) {
int html_resource_id) {
content::WebUIDataSource* source = content::WebUIDataSource::CreateAndAdd(
Profile::FromWebUI(web_ui), std::string(name));
// Some parts of Brave's UI pages are not yet migrated to work without doing
// assignments of strings directly into |innerHTML| elements (i.e. see usage
// of |dangerouslySetInnerHTML| in .tsx files). This will break Brave due to
// committing a Trusted Types related violation now that Trusted Types are
// enforced on WebUI pages (see crrev.com/c/2234238 and crrev.com/c/2353547).
// We should migrate those pages not to require using |innerHTML|, but for now
// we just restore pre-Cromium 87 behaviour for pages that are not ready yet.
if (disable_trusted_types_csp) {
source->DisableTrustedTypesCSP();
} else {
// Allow a policy to be created so that we
// can allow trusted HTML and trusted lazy-load script sources.
source->OverrideContentSecurityPolicy(
network::mojom::CSPDirectiveName::TrustedTypes,
"trusted-types default;");
}
// Allow a policy to be created so that we
// can allow trusted HTML and trusted lazy-load script sources.
source->OverrideContentSecurityPolicy(
network::mojom::CSPDirectiveName::TrustedTypes, "trusted-types default;");
source->UseStringsJs();
source->SetDefaultResource(html_resource_id);
@@ -83,11 +70,9 @@ content::WebUIDataSource* CreateAndAddWebUIDataSource(
content::WebUI* web_ui,
std::string_view name,
base::span<const webui::ResourcePath> resource_paths,
int html_resource_id,
bool disable_trusted_types_csp) {
int html_resource_id) {
content::WebUIDataSource* data_source =
CreateWebUIDataSource(web_ui, name, resource_paths, html_resource_id,
disable_trusted_types_csp);
CreateWebUIDataSource(web_ui, name, resource_paths, html_resource_id);
return data_source;
}
browser/ui/webui/brave_webui_source.h
+1 -2
View File
@@ -26,8 +26,7 @@ content::WebUIDataSource* CreateAndAddWebUIDataSource(
content::WebUI* web_ui,
std::string_view name,
base::span<const webui::ResourcePath> resource_paths,
int html_resource_id,
bool disable_trusted_types_csp = false);
int html_resource_id);
#if !BUILDFLAG(IS_ANDROID)
browser/ui/webui/welcome_page/brave_welcome_ui.cc
+2 -2
View File
@@ -46,6 +46,7 @@
#include "content/public/browser/url_data_source.h"
#include "content/public/browser/web_ui_data_source.h"
#include "content/public/browser/web_ui_message_handler.h"
#include "services/network/public/mojom/content_security_policy.mojom-shared.h"
#include "ui/base/l10n/l10n_util.h"
namespace {
@@ -111,8 +112,7 @@ void OpenJapanWelcomePage(Profile* profile) {
BraveWelcomeUI::BraveWelcomeUI(content::WebUI* web_ui, std::string_view name)
: WebUIController(web_ui) {
content::WebUIDataSource* source = CreateAndAddWebUIDataSource(
web_ui, name, kBraveWelcomeGenerated, IDR_BRAVE_WELCOME_HTML,
/*disable_trusted_types_csp=*/true);
web_ui, name, kBraveWelcomeGenerated, IDR_BRAVE_WELCOME_HTML);
// Lottie animations tick on a worker thread and requires the document CSP to
// be set to "worker-src blob: 'self';".
components/brave_welcome_ui/BUILD.gn
-1
View File
@@ -48,7 +48,6 @@ copy("welcome_sky") {
}
transpile_web_ui("brave_welcome_ui") {
output_module = false
entry_points = [ [
"brave_welcome",
rebase_path("brave_welcome.tsx"),
components/brave_welcome_ui/brave_welcome.html
+1 -1
View File
@@ -26,7 +26,7 @@
</style>
</head>
<body>
<script src="/brave_welcome.bundle.js"></script>
<script type="module" src="/brave_welcome.bundle.js"></script>
<div id="root" />
</body>
</html>
ios/web/webui/brave_webui_utils.h
+1 -2
View File
@@ -28,8 +28,7 @@ BraveWebUIIOSDataSource* CreateAndAddWebUIDataSource(
web::WebUIIOS* web_ui,
std::string_view name,
base::span<const webui::ResourcePath> resource_paths,
int html_resource_id,
bool disable_trusted_types_csp = false);
int html_resource_id);
} // namespace brave
ios/web/webui/brave_webui_utils.mm
+1 -6
View File
@@ -37,8 +37,7 @@ BraveWebUIIOSDataSource* CreateAndAddWebUIDataSource(
web::WebUIIOS* web_ui,
std::string_view name,
base::span<const webui::ResourcePath> resource_paths,
int html_resource_id,
bool disable_trusted_types_csp) {
int html_resource_id) {
auto* source = BraveWebUIIOSDataSource::CreateAndAdd(
ProfileIOS::FromWebUIIOS(web_ui), name);
@@ -50,10 +49,6 @@ BraveWebUIIOSDataSource* CreateAndAddWebUIDataSource(
CustomizeWebUIHTMLSource(web_ui, name, source);
if (disable_trusted_types_csp) {
source->DisableTrustedTypesCSP();
}
return source;
}