1012665 - [System] Remove inline style for CSP compliance

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::System, defect)

Description

[:gerard-majax]

Confere bug 968907 and bug 858787. We need to remove all CSS inline usage in certified apps.

https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/devtools_view.js#L106

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

The link above doesn't work for me, so maybe this is gone, but we need to remove the <style> tag from the main index (https://github.com/mozilla-b2g/gaia/blob/master/apps/system/index.html#L388)

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Also from looking at the system app in the profile, the application.zip file has a file called net_error.html in it. The source file in gaia seems ok, but the file in the zip seems to have all of its CSS inclined as well as inline script.... I have no idea how that would ever work at the moment, since CSP should definitely block inline script already.

Comment 3

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

(In reply to Alexandre LISSY :gerard-majax from comment #0)
> Confere bug 968907 and bug 858787. We need to remove all CSS inline usage in
> certified apps.
> 
> https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/devtools_view.
> js#L106

The patch in bug 971008 should remove the devtools part.

Comment 4

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

(In reply to Paul Theriault [:pauljt] from comment #2)
> Also from looking at the system app in the profile, the application.zip file
> has a file called net_error.html in it. The source file in gaia seems ok,
> but the file in the zip seems to have all of its CSS inclined as well as
> inline script.... I have no idea how that would ever work at the moment,
> since CSP should definitely block inline script already.

This file is loaded by the platform, in the scope of the app with special privileges. The CSP should not apply to it.

Comment 5

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

Attachment: csp.system.patch

Tim is there any issue if we move this css declaration here ?

Comment 6

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Comment on attachment 8437352 [details] [diff] [review]
csp.system.patch

For the purpose of the review I can r+ this for you to land this patch.

I however don't know the answer to your question. I don't understand Gecko well enough to say if this patch will cause FOUC or not, especially since we are talking about packaged apps here.

Comment 7

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

https://tbpl.mozilla.org/?tree=Gaia-Try&rev=36b230201cd25f116b7cd8b77ded435ca7bfa5ec

Comment 8

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

Try is green. https://github.com/mozilla-b2g/gaia/commit/fd6aa50c8c2bd2449d33974fcfb6eddaccb6692d