Bug 248066

Summary:	Block loading remote content in console message style formatter.
Product:	WebKit	Reporter:	Ryan Reno <rreno>
Component:	Web Inspector	Assignee:	Ryan Reno <rreno>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	inspector-bugzilla-changes, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Ryan Reno 2022-11-17 16:13:00 PST

The console spec doesn't specify the behavior of the %c formatter. There isn't a great use case for loading remote content in any of our allowed CSS properties so we should block the use of url and src CSS functions.

Comment 1 Ryan Reno 2022-11-17 16:13:15 PST

<rdar://problem/101434152>

Comment 2 Ryan Reno 2022-11-17 16:15:42 PST

Pull request: https://github.com/WebKit/WebKit/pull/6613

Comment 3 EWS 2022-11-18 10:10:47 PST

Committed 256840@main (e0bf4081c1a0): <https://commits.webkit.org/256840@main>

Reviewed commits have been landed. Closing PR #6613 and removing active labels.