796869 - [contacts] Get ready for CSP

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia, defect, P1)

Description

[Francisco Jordano [:arcturus] [:francisco]]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.79 Safari/537.4

Steps to reproduce:

Current contacts application is not ready for CSP.

Currently the policy allows:
script-src: 'self' 'unsafe-inline'; object-src: 'none'; style-src: 'self' ;

But in the future will be:
script-src: 'self'; object-src: 'none'; style-src: 'self' ;

Which means that inline scripts will be eliminated.


Actual results:

Contacts app is 'abusing' the inline scripts for several actions


Expected results:

in-line scripts should be removed

Comment 1

[Francisco Jordano [:arcturus] [:francisco]]

Tried to add the patch with the addon but it's not working, anyway can review the changes in the PR:

https://github.com/mozilla-b2g/gaia/pull/5637

Thanks

Comment 2

[Francisco Jordano [:arcturus] [:francisco]]

Jose Manuel can you r? as well

Comment 3

[Jose Manuel Cantera]

yep

Comment 4

[Francisco Jordano [:arcturus] [:francisco]]

Attachment: Patch v1

Comment 5

[Jose Manuel Cantera]

First set of comments provided through Github at https://github.com/mozilla-b2g/gaia/pull/5637/files

Comment 6

[alberto.pastor]

I agree with Jose Manuel in using separate function for the listeners. Apart from that r+ from my side.

Comment 7

[Francisco Jordano [:arcturus] [:francisco]]

Attachment: Patch v2

Patch v2

no with specific functions and trying to do a smarter way of walking the elements

Comment 8

[Francisco Jordano [:arcturus] [:francisco]]

Attachment: Patch v3

Comment 9

[Francisco Jordano [:arcturus] [:francisco]]

Landed in gaia:

https://github.com/mozilla-b2g/gaia/pull/5637

Comment 10

[Francisco Jordano [:arcturus] [:francisco]]

Latest changes on the building blocks brought back some of the infamous inline javascript.

Comment 11

[Jose Manuel Cantera]

yep, the onclick=return false. We need to be very careful during code reviews ...

Comment 12

[Francisco Jordano [:arcturus] [:francisco]]

Attachment: Follow up after the building blocks

Comment 13

[Francisco Jordano [:arcturus] [:francisco]]

Landed:

https://github.com/mozilla-b2g/gaia/commit/dd1b8b015a930b9668f7b2f862700307a8153103