1146596 - Apply a content security policy to the reader view content that we serve

Status: RESOLVED FIXED

(Firefox for iOS :: Reader View, defect)

Description

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Apply a CSP header to the /reader-mode/page endpoint that serves readability content. The policy can simply disallow embedded scripts, css, iframes and xhr. I think the only thing that should be allowed now are remote images.

Comment 1

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Attachment: PR: https://github.com/mozilla/firefox-ios/pull/602

This patch sets a *Content Security Policy* on pages served for Reading View. I've broken the patch down in small changes.

The policy that we set is as follows:

> `default-src 'none'; img-src *; style-src http://localhost:*; font-src http://localhost:*`

This allows nothing by default. (No script, no inline, no objects, no iframes). And then makes an exception for styles and fonts to be loaded from localhost.

Comment 2

[Stephan Leroux [:sleroux]]

Comment on attachment 8622510 [details] [review]
PR: https://github.com/mozilla/firefox-ios/pull/602

LGTM!

Comment 3

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8622510 [details] [review]
PR: https://github.com/mozilla/firefox-ios/pull/602

Looks good to me.