Integrate with speculation rules

[vickiez]

Adds the following:

From #776:

• Handling of the new "speculationrules" request destination, which is used by the Speculation-Rules HTTP header

Note: No longer need to add inline-speculation-rules from #776 because it is redundant with the addition of the speculation-rules-src directive described below.

New additions:

• New speculation-rules-src fetch directive that restricts the sources from which speculation rules may be loaded, whether via <script> elements or the Speculation-Rules HTTP response header
• Fallback chain: speculation-rules-src → script-src-elem → script-src → default-src, applied uniformly to both inline and external speculation rules
• Handling of the "speculationrules" request destination now returns speculation-rules-src (removing the previous header exemption that returned null).

This reflects the agreed plan from whatwg/html#11697

---

Preview | Diff

[antosart]

We don't need the keyword inline-speculation-rules if we have speculation-rules-src, no? Developers will just be able to specify speculation-rules src 'unafe-inline'; script-src 'none' or something. I think having both is just confusing.

[hiroshige-g]

IIUC (please correct me if wrong) this PR contains a major behavior changes that would break existing websites without updates to pages' CSP :
Applying speculation-rules-src CSP directive to Speculation-Rules header-initiated requests to external speculation-rules JSON files (while previously CSP is exempted per https://chromestatus.com/feature/5123809745829888).

To avoid breakage, pages should e.g. add speculation-rules-src directive that allows the requests to the JSON files if the pages have e.g. script-src CSP directives that would forbid the requests (which is likely).

cc/ @tunetheweb @nhiroki WDYT?

FYI Also see whatwg/html#11697 (comment) whatwg/html#11697 (comment) and around for previous context for direction/planning around external speculation rules.

[hiroshige-g]

Also this PR applies speculation-rules-src CSP directive instead of script-src-elem to <script type="speculationrules"> (i.e. inline speculation rules).
This would keep the existing behavior (because we'll anyway fallback to script-src-elem), if pages already have speculation-rules-src CSP directive (which is unlikely). This just opens a new option to specify speculation-rules-src without affecting more general script-src-elem.

[tunetheweb]

Yes I thought we’d previously agreed that the HTTP Header version was out of scope? Because if you’ve the ability to set HTTP Headers then you’ve no guarantees on CSP anyway (since that is also usually set via HTTP Headers).

Also can I understand which this does for inline-speculation-rules for <script type="speculationrules">? Is this replacing that with the new speculation-rules-src: inline directive? That would cause breakage to anyone who’s already deployed this under the old name so we need to check the web compatibility of any such change.

[annevk]

CSP should apply to links in HTTP headers as well to remain consistent.