1082924 - Add nsIContentPolicy::TYPE_FETCH

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

The fetch specification[1] uses it for fetching Requests created by content code. Behaviour is similar to XHR in being restricted by CSP directive connect-src.

[1]: https://fetch.spec.whatwg.org

Comment 1

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Attachment: Add CSP type for fetch API

Comment 2

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Comment on attachment 8505111 [details] [diff] [review]
Add CSP type for fetch API

Tanvi for content/
Andrea for dom/fetch oneliner.

Comment 3

[Andrea Marchesini [:baku]]

Comment on attachment 8505111 [details] [diff] [review]
Add CSP type for fetch API

Review of attachment 8505111 [details] [diff] [review]:
-----------------------------------------------------------------

I'm not familiar with nsIContentPolicy.

Comment 4

[Tanvi Vyas[:tanvi]]

Comment on attachment 8505111 [details] [diff] [review]
Add CSP type for fetch API

Do other content policies need to be updated?  Examples -
https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsDataDocumentContentPolicy.cpp#118
https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsNoDataProtocolContentPolicy.cpp#34
https://mxr.mozilla.org/mozilla-central/source/embedding/browser/nsWebBrowserContentPolicy.cpp#49

Can we add a CSP test for this?

Comment 5

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Tanvi, so I can only really test the TYPE_FETCH in the fetch specification tests (Bug dom-fetch-api) since fetch() is the only user of the type. I will add tests there in the patches that add CSP support (not up yet) and mark you for review there. Does that sound good?

Comment 6

[Tanvi Vyas[:tanvi]]

https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsDataDocumentContentPolicy.cpp#118 should probably use a whitelist instead of a blacklist.  I'll file a bug for that.  For now, please add TYPE_FETCH to the blacklist.

Comment 7

[Tanvi Vyas[:tanvi]]

(In reply to Nikhil Marathe [:nsm] (needinfo? please) from comment #5)
> Tanvi, so I can only really test the TYPE_FETCH in the fetch specification
> tests (Bug dom-fetch-api) since fetch() is the only user of the type. I will
> add tests there in the patches that add CSP support (not up yet) and mark
> you for review there. Does that sound good?

That sounds good.

Comment 8

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Attachment: Add CSP type for fetch API

With check added to nsData...

Comment 9

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Comment on attachment 8506617 [details] [diff] [review]
Add CSP type for fetch API

Andrea, the review isn't for the CSP, but for setting Request::mContext in GetRequestConstructorCopy as defined by the fetch spec in Request constructor step 3.

Comment 10

[Tanvi Vyas[:tanvi]]

Comment on attachment 8506617 [details] [diff] [review]
Add CSP type for fetch API

Please be sure to add a csp test for TYPE_FETCH in bug dom-fetch-api.  Thanks!

Comment 11

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ac4bf4d89545

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/ac4bf4d89545

Comment 13

[Eric Shepherd [:sheppy]]

Updated document: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIContentPolicy

Added to: https://developer.mozilla.org/en-US/Firefox/Releases/36