1125565 - Extra CSP violation reports when using nonce-source

Status: RESOLVED DUPLICATE of bug 1026520

(Core :: DOM: Security, defect)

Description

[Danesh]

Attachment: HTML including simple javascript to test CSP nonc'ing.

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Steps to reproduce:

1) Serve attached html page with a CSP header of
"Content-Security-Policy: script-src 'nonce-AaBbCcDdEeAaBbCcDdEe890abcdef';report-uri /tmp"
2) Observe network requests and html output.


Actual results:

1) Three CSP violation reports are generated and sent to the report-uri, although there should only be one CSP violation report.
2) Even though the script is properly nonced it still reports violations (although it executes the document.write).


Expected results:

1) Only one CSP violation report for the one script tag that has an incorrect nonce.
2) No CSP violation report for the properly nonced script.

There seems to a bug that sends a violation report too early, prior to checking if the script is properly nonced. This is why a plain script tag (with no nonce attribute) will only generate one CSP violation*, whereas a script tag with an invalid nonce will generate two CSP violations, and a script with a valid nonce only generates one CSP violation (for the initial "try" without the nonce).

[*] - Expected behavior for a single script tag and not included in below HTML.

Comment 1

[Danesh]

Attachment: Screenshot from dev-tools.

Comment 2

[Mike West]

Hey Sid, Dan, would you mind triaging this to the right folks?

Comment 3

[Danesh]

The bug seems to be here (http://mxr.mozilla.org/mozilla-central/source/dom/base/nsScriptLoader.cpp#462).
Namely, reportInlineViolation is checked and violations.AppendElement is called before checking for nonce or hash. When a nonce/hash are checked, violations.AppendElement is called again.

P.S. It seems like you might be able to get a single script block to throw three violations by specifying both a nonce and hash in the CSP header and specifying a bad nonce and bad hash for the script element.

Comment 4

[Daniel Veditz [:dveditz]]

Christoph: is this yours?

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Danesh, thanks for filing. We just triaged CSP bugs and Francois is going to fix the issue in Bug 1026520. Marking this bug as a duplicate and CC you on the other bug.