Resource hint blocking / "least restrictive" as specified does nothing?

[evilpie]

"6.7.2.2 Does resource hint request violate policy?" executes the pre-request check on every directive.

The pre-request check of almost all directives looks like this (e.g. img-src Pre-request check):

1. Let name be the result of executing § 6.8.1 Get the effective directive for request on request.
2. If the result of executing § 6.8.4 Should fetch directive execute on name, img-src and policy is "No", return "Allowed".

6.8.1. Get the effective directive for request

1. If request’s initiator is "prefetch" or "prerender", return default-src.

6.8.4. Should fetch directive execute

1. Let directive fallback list be the result of executing § 6.8.3 Get fetch directive fallback list on effective directive name.

6.8.3 Get fetch directive fallback list

1. Switch on directive name: (This does not include default-src)
2. Return << >>.

So we probably need to extend 6.8.3. However that still means we would only match the explicit default-src. In the end it seems like using the pre-request check, for what is a totally unrelated request, is just bound to cause issues.
Maybe it would be better to have an explicit list of supported directives e.g. img/video/script etc. and just call § 6.7.2.4 Does request match source list? directly from 6.7.2.2.

#582
/cc @noamr

[noamr]

Thanks, yes I can see the bug in the spec. Since this is implemented in Chromium I'll try to find where they diverge and amend the spec.

[noamr]

I'm seeing that here we call "Get the effective directive for request" but that doesn't exist in chromium, istead there is something called the "operative directive".
@antosart or others, do you have any background for this?

[antosart]

I think "Get the effective directive for request" corresponds in chromium to GetDirectiveTypeFromRequestContextType.

I don't know the background, but I suspect that the implementation diverges from the spec for optimization reasons (for example for an image, the spec mandates to do a loop over all directives and perform the pre-request check of every directive, but that pre-request check will be useless unless the directive is img-src or (if there is no img-src) default-src, so what chromium does instead is: check if there is img-src or else fallback to default-src and just perform that one pre-request check).

Maybe it would be better to have an explicit list of supported directives e.g. img/video/script etc. and just call § 6.7.2.4 Does request match source list? directly from 6.7.2.2.

I think this is the best way to go.

[noamr]

OK then! #637

[jonathanKingston]

@noamr can I check the wording of the default directive also:

If |defaultDirective| does not exist, return "Does Not Violate"

In the absence of a default-src, doesn't that skip all validation? I'm assuming that's not the intended behaviour at least.