ldm0 651b3c98f9 fix(csp): retain inherited self for script element admission ...

Check enforced and report-only script URLs against the policy's retained self URL while preserving the protected Document URL in violation reports. This lets initial about:blank popup script elements load same-origin modules without widening cross-origin policy.

Strengthen the real auxiliary-target regression with inherited script-src/connect-src self and an unchanged about:blank URL. Cover positive and negative script policies plus reporting for blank, srcdoc and data Documents.

Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (23552 passed, 18 existing skips; 32 threads, no retries).

2026-11-03 18:08:18 +08:00

..

src

fix(csp): retain inherited self for script element admission

2026-11-03 18:08:18 +08:00

tests/fixtures

fix(csp): retain inherited self for script element admission

2026-11-03 18:08:18 +08:00

Cargo.toml

refactor(storage): retire protocol cookie profiles and close partitions once

2026-11-01 04:03:38 +08:00