1033001 - XHR doesn't respect connect-src after CPP CSP

Status: RESOLVED DUPLICATE of bug 1031530

(Core :: DOM: Security, defect)

Description

[Reuben Morais [:reuben]]

When trying to use the rTorrent WebUI on Nightly I ran into CSP problems. The policy is:

Content-Security-Policy: default-src 'none'; img-src 'self' data:;  frame-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self';

The page is trying to XHR a script in the same subdomain and getting rejected with the following error message:

Content Security Policy: The page's settings blocked the loading of a resource at https://foo.bar.ca/webui/php/getplugins.php ("default-src 'none'").
Content Security Policy: The page's settings blocked the loading of a resource at https://foo.bar.ca/webui/php/getsettings.php ("default-src 'none'").

I don't understand why we're falling back to the default-src directive when there's a connect-src in the CSP line.

Comment 1

[Reuben Morais [:reuben]]

(The web interface in question is ruTorrent.)

Comment 2

[Christoph Kerschbaumer [:ckerschb, back on Aug 10th}]

From what I see this is a duplicate to:
https://bugzilla.mozilla.org/show_bug.cgi?id=1031530 which is currently on try and about to land shortly.

Comment 3

[Christoph Kerschbaumer [:ckerschb, back on Aug 10th}]

Reuben, https://bugzilla.mozilla.org/show_bug.cgi?id=1031530 landed, that should have resolved the problem, can you verify and close this bug if it works correctly?

Comment 4

[Reuben Morais [:reuben]]

I will when it hits Nightly tomorrow.

Comment 5

[Reuben Morais [:reuben]]

Yep, it's working :D