Skip to content

merge_pr_9025

This fixes bug 798698. It happens when the "form-action 'self'" CSP is
used and a form submission with the attribute "target='_blank'" happens.
Since the form-action CSP is checked against the CSP of the new windows
instead of the one of the old window, it was blocked.

This regression probably started after this CL (which is good):
https://chromium-review.googlesource.com/c/chromium/src/+/765969.

Solution was to disable browser side checks and only rely on renderer
side checks for the initial load.

Bug: 798698
Change-Id: Iade17b80f493af265ddb86fe95305d96c7ce0975
Reviewed-on: https://chromium-review.googlesource.com/857503
Commit-Queue: Arthur Sonzogni <[email protected]>
Reviewed-by: Mike West <[email protected]>
Reviewed-by: Łukasz Anforowicz <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Cr-Commit-Position: refs/heads/master@{#529255}
Assets 2
Loading