1052887 - Websocket redirects don't honor CSP

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[Tanvi Vyas[:tanvi]]

If a page has a CSP policy, the CSP policy is set on subresource channels via channelPolicy.  If the subresource goes through a redirect, channelPolicy is used to determine if the new destination is allowed per the main page's CSP.

Websockets do not set channelPolicy.  And hence, websocket redirects go through without checking with CSP.  Luckily, this isn't a huge security hole because websocket redirects are turned off by default:

network.websocket.auto-follow-http-redirect = false

So the issue exists issue if the user or an addon sets this pref to true.  A grep through the addons mxr doesn't show any addons setting this to true:
https://mxr.mozilla.org/addons/search?string=auto-follow-http-redirects

However, even if the pref is set to false, our code allows websocket redirects if we are upgrading from ws://unique_uri to wss://unique_uri
http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/websocket/WebSocketChannel.cpp#2478

Suppose a page has a CSP policy that allows only ws://unique_uri.  Https-Everywhere or HSTS might auto-upgrade ws://unique_uri to wss://unique_uri.  The browser will allow the wss://unique_uri load even though it doesn't honor the pages CSP.

This bug is to ensure that the CSP policy is honored even after websocket redirects.  This means that we first have to add the necessary info to websocket channels to perform a csp check, which we have to do this anyway in bug 1037669.

As a separate bug (which I will file shortly), we can remove the code and the pref to support websocket redirects.

Comment 1

[Tanvi Vyas[:tanvi]]

> As a separate bug (which I will file shortly), we can remove the code and
> the pref to support websocket redirects.

Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1052909

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

I think bug https://bugzilla.mozilla.org/show_bug.cgi?id=1041180 fixed that, we should verify in our next triage.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

I don't have time to fix that right now - let's put it in the backlog.