Repository: LadybirdBrowser/ladybird
File: Libraries/LibWeb/ContentSecurityPolicy/BlockingAlgorithms.cpp (C++)

Code before:
    // 2. Let parsedMetadata be the result of calling parse metadata with request’s integrity metadata.
    auto parsed_metadata = MUST(SRI::parse_metadata(request->integrity_metadata()));

    // 3. If parsedMetadata is not the empty set and request’s mode is either "cors" or "same-origin", return "Allowed".
    if (!parsed_metadata.is_empty() && (request->mode() == Fetch::Infrastructure::Request::Mode::CORS || request->mode() == Fetch::Infrastructure::Request::Mode::SameOrigin))
        return Directives::Directive::Result::Allowed;

    // 4. If request’s url is local, return "Allowed".
    if (Fetch::Infrastructure::is_local_url(request->url()))
        return Directives::Directive::Result::Allowed;

    // 5. Let policy be policyContainer’s integrity policy.
    auto const& policy = policy_container->integrity_policy;

    // 6. Let reportPolicy be policyContainer’s report only integrity policy.
    auto const& report_policy = policy_container->report_only_integrity_policy;

    // 7. If both policy and reportPolicy are empty integrity policys, return "Allowed".
    if (policy.is_empty() && report_policy.is_empty())
        return Directives::Directive::Result::Allowed;

    // 8. Let global be request’s client’s global object.
    auto& global = request->client()->global_object();

    // 9. If global is not a Window nor a WorkerGlobalScope, return "Allowed".
    if (!is<HTML::Window>(global) || !is<HTML::WorkerGlobalScope>(global))
        return Directives::Directive::Result::Allowed;

    // 10. Let block be a boolean, initially false.
    bool block = false;

    // FIXME: 11. Let reportBlock be a boolean, initially false.
    [[maybe_unused]] auto report_block = false;

    // 12. If policy’s sources contains "inline" and policy’s blocked destinations contains request’s destination, set block to true.
    if (policy.sources.contains_slow("inline"sv)
        && request->destination().has_value()
        && policy.blocked_destinations.contains_slow(request->destination().value()))
        block = true;

    // 13. If reportPolicy’s sources contains "inline" and reportPolicy’s blocked destinations contains request’s destination, set reportBlock to true.
    if (report_policy.sources.contains_slow("inline"sv)
        && request->destination().has_value()
        && report_policy.blocked_destinations.contains_slow(request->destination().value()))
        report_block = true;

    // FIXME: 14. If block is true or reportBlock is true, then report violation with request, block, reportBlock, policy and reportPolicy.

    // 15. If block is true, then return "Blocked"; otherwise "Allowed".
    return block ? Directives::Directive::Result::Blocked : Directives::Directive::Result::Allowed;
}

Review comment (suggestion):
issue: This will always return true, since a global can't be both types.
suggestion: Replace `||` with `&&`
```suggestion
    if (!is<HTML::Window>(global) && !is<HTML::WorkerGlobalScope>(global))
```

Code after:
    // 2. Let parsedMetadata be the result of calling parse metadata with request’s integrity metadata.
    auto parsed_metadata = MUST(SRI::parse_metadata(request->integrity_metadata()));

    // 3. If parsedMetadata is not the empty set and request’s mode is either "cors" or "same-origin", return "Allowed".
    if (!parsed_metadata.is_empty() && (request->mode() == Fetch::Infrastructure::Request::Mode::CORS || request->mode() == Fetch::Infrastructure::Request::Mode::SameOrigin))
        return Directives::Directive::Result::Allowed;

    // 4. If request’s url is local, return "Allowed".
    if (Fetch::Infrastructure::is_local_url(request->url()))
        return Directives::Directive::Result::Allowed;

    // 5. Let policy be policyContainer’s integrity policy.
    auto const& policy = policy_container->integrity_policy;

    // 6. Let reportPolicy be policyContainer’s report only integrity policy.
    auto const& report_policy = policy_container->report_only_integrity_policy;

    // 7. If both policy and reportPolicy are empty integrity policys, return "Allowed".
    if (policy.is_empty() && report_policy.is_empty())
        return Directives::Directive::Result::Allowed;

    // 8. Let global be request’s client’s global object.
    auto& global = request->client()->global_object();

    // 9. If global is not a Window nor a WorkerGlobalScope, return "Allowed".
    if (!is<HTML::Window>(global) && !is<HTML::WorkerGlobalScope>(global))
        return Directives::Directive::Result::Allowed;

    // 10. Let block be a boolean, initially false.
    bool block = false;

    // FIXME: 11. Let reportBlock be a boolean, initially false.
    [[maybe_unused]] auto report_block = false;

    // 12. If policy’s sources contains "inline" and policy’s blocked destinations contains request’s destination, set block to true.
    if (policy.sources.contains_slow("inline"sv)
        && request->destination().has_value()
        && policy.blocked_destinations.contains_slow(request->destination().value()))
        block = true;

    // 13. If reportPolicy’s sources contains "inline" and reportPolicy’s blocked destinations contains request’s destination, set reportBlock to true.
    if (report_policy.sources.contains_slow("inline"sv)
        && request->destination().has_value()
        && report_policy.blocked_destinations.contains_slow(request->destination().value()))
        report_block = true;

    // FIXME: 14. If block is true or reportBlock is true, then report violation with request, block, reportBlock, policy and reportPolicy.

    // 15. If block is true, then return "Blocked"; otherwise "Allowed".
    return block ? Directives::Directive::Result::Blocked : Directives::Directive::Result::Allowed;
}