X-Frame-Options should only strip tab or space

annevk · annevk · commit a9bbaa7e6d3e · 2026-01-27T08:16:55.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=272745 rdar://126915315 Reviewed by Youenn Fablet. As per https://html.spec.whatwg.org/multipage/speculative-loading.html#the-x-frame-options-header which calls into https://fetch.spec.whatwg.org/#concept-header-list-get-decode-split New tests: web-platform-tests/wpt#57341 Canonical link: https://commits.webkit.org/306279@main
diff --git a/LayoutTests/imported/w3c/web-platform-tests/x-frame-options/get-decode-split-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/x-frame-options/get-decode-split-expected.txt
@@ -3,4 +3,8 @@ PASS `,SAMEORIGIN,,DENY,` blocks same-origin framing
 PASS `,SAMEORIGIN,,DENY,` blocks cross-origin framing
 PASS `  SAMEORIGIN,    DENY` blocks same-origin framing
 PASS `  SAMEORIGIN,    DENY` blocks cross-origin framing
+PASS `DENY` allows same-origin framing
+PASS `DENY` allows cross-origin framing
+PASS `DENY` allows same-origin framing
+PASS `DENY` allows cross-origin framing
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/x-frame-options/get-decode-split.html b/LayoutTests/imported/w3c/web-platform-tests/x-frame-options/get-decode-split.html
@@ -20,4 +20,16 @@
   sameOriginAllowed: false,
   crossOriginAllowed: false
 });
+
+xfo_simple_tests({
+  headerValue: `\x0BDENY`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `\x0CDENY`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
 </script>
diff --git a/LayoutTests/platform/win/TestExpectations b/LayoutTests/platform/win/TestExpectations
@@ -1992,6 +1992,9 @@ imported/w3c/web-platform-tests/event-timing/interaction-count-tap.html [ Crash
 imported/w3c/web-platform-tests/event-timing/interaction-count-click.html [ Skip ]
 imported/w3c/web-platform-tests/event-timing/interaction-count-press-key.html [ Skip ]
 
+# Incorrect whitespace stripping might happen at the network layer?
+imported/w3c/web-platform-tests/x-frame-options/get-decode-split.html [ Skip ]
+
 # Timeout:
 webkit.org/b/301110 imported/w3c/web-platform-tests/event-timing/gap-keydown-keyup.html [ Skip ]
 webkit.org/b/301110 imported/w3c/web-platform-tests/event-timing/gap-pointerdown-pointerup.html [ Skip ]
diff --git a/Source/WebCore/platform/network/HTTPParsers.cpp b/Source/WebCore/platform/network/HTTPParsers.cpp
@@ -565,7 +565,7 @@ XFrameOptionsDisposition parseXFrameOptionsHeader(StringView header)
         return result;
 
     for (auto currentHeader : header.splitAllowingEmptyEntries(',')) {
-        currentHeader = currentHeader.trim(isUnicodeCompatibleASCIIWhitespace<char16_t>);
+        currentHeader = currentHeader.trim(isTabOrSpace<char16_t>);
         XFrameOptionsDisposition currentValue = XFrameOptionsDisposition::None;
         if (equalLettersIgnoringASCIICase(currentHeader, "deny"_s))
             currentValue = XFrameOptionsDisposition::Deny;

-Original file line number
+Diff line change
 PASS `,SAMEORIGIN,,DENY,` blocks cross-origin framing
 PASS `  SAMEORIGIN,    DENY` blocks same-origin framing
 PASS `  SAMEORIGIN,    DENY` blocks cross-origin framing
 +PASS `DENY` allows same-origin framing
 +PASS `DENY` allows cross-origin framing
 +PASS `DENY` allows same-origin framing
 +PASS `DENY` allows cross-origin framing