1457100 - (CVE-2020-12391) CSP: embedding resource's policy does not affect data: URL documents loaded via OBJECT elements

Status: VERIFIED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Giorgio Maone [:ma1]]

Step to reproduce:

1. Navigate the following data URL (or create a HTML document with the same content and navigate it):
data:text/html,<meta http-equiv="Content-security-policy" content="script-src none;"/><script>alert(location)</script><object data="data:text/html,object<script>alert('object')</script>"></object><iframe src="data:text/html,iframe<script>alert('frame')</script>"></iframe>

Expected result: no JavaScript gets executed (no alert is shown)
Actual result: one alert saying "object" is shown

This demonstrates that the iframe's document inherits parent's CSP, but the object's document doesn't. According to https://www.w3.org/TR/CSP2/#which-policy-applies they should behave the same way, i.e. being governed by "the policy of the embedding resource".

This can be also used to bypass WebExtensions relying on CSP to block scripts: even though the embedded document has null origin, it could deliver a self-contained exploit.

Comment 1

[Daniel Veditz [:dveditz]]

This should be easier to fix when we move CSP to the loadinfo (bug 965637)

Comment 3

[Daniel Veditz [:dveditz]]

Did this actually get fixed by bug 965637 as predicted?

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

I am clearing old ni?s at the moment and I realized bug 965637 did not fix the problem described here, though it made it easier to fix the problem described here. Assigning to myself.

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1457100: Make OBJECT elements inherit CSP if opaque. r=smaug

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/ec542d9a0338166e2442a77b8f052c3b054a7fd7
https://hg.mozilla.org/mozilla-central/rev/ec542d9a0338

Comment 8

[Rares Doghi, Desktop QA]

This issue is verified as fixed in our latest Nightly build 76.0a1 (2020-04-01) on Windows 10, Mac os 10.13 and Ubuntu 16.04.

Comment 9

[Frederik Braun [:freddy]]

Attachment: advisory.txt