@Hexcles: I'm not sure this CL gives a good solution. Just try to find out why the escaping character in policy value ('self') has been converted Hex value in python 3 case. Anything obvious to you?

Where is policy coming from? Something like {{GET[...]}}?

Looks like we are getting the URL-encoded version of the string.

Where is policy coming from? Something like {{GET[...]}}?

It should come from this line

Looks like we are getting the URL-encoded version of the string.

That's what I suspected as well. I couldn't see any direct calls of .py file in these test scripts. Could it be something at wpt core part?

@ziransun yeah I'm looking at wptserve.

Meanwhile, could you provide some concrete examples (comparison of strings in Py2 and 3, as well as the test that triggers it)?

I'm guessing this is https://github.com/web-platform-tests/wpt/blob/7c50c216081d6ea3c9afe553ee7b64534020a1b2/content-security-policy/navigation/javascript-url-navigation-inherits-csp.html

Hmm, I also see

var window_url = decodeURIComponent("javascript:&#x27;&lt;iframe src=/content-security-policy/support/fail.js /&gt;&#x27;").replace('&lt;', '<').replace('&gt;', '>');

in Python 2. In other words, this doesn't seem to happen in Python 3 only.

Reading the source code, I think this is the expected behaviour:

sets escape_type to html, which leads to content to be percent-encoded in the output. And this test is hence a bit problematic... I think we'd need something like #25275 (just a PoC for now).

#25275 landed, so let's close this PR.