1268327 - ReferrerPolicy should not be delivered through CSPRO

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Thomas Nguyen (:tnguyen)]

In [1], should check report-only before adding referrerPolicy (only add in case non-report-only policy)
[1] https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPContext.cpp#335

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Thanks Thomas - please also add a test to make sure we never regress that.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1268327_referrer_policy_ro.patch

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5caf96a61a42

Comment 3

[Thomas Nguyen (:tnguyen)]

Comment on attachment 8764185 [details] [diff] [review]
bug_1268327_referrer_policy_ro.patch

Review of attachment 8764185 [details] [diff] [review]:
-----------------------------------------------------------------

Lgtm.
Could we add a case that both a Content-Security-Policy-Report-Only header and a Content-Security-Policy header are present?

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1268327_referrer_policy_ro.patch

(In reply to Thomas Nguyen[:tnguyen] from comment #3)
> Could we add a case that both a Content-Security-Policy-Report-Only header
> and a Content-Security-Policy header are present?

Sure can, added another test that delivers a CSP and a CSPRO.
Carrying over r+!
TRY looks good, this is ready to land!

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0bed705c1430

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0bed705c1430