Closed Bug 1157724 Opened 9 years ago Closed 9 years ago

html5test doesn't detect script execution events

Categories

(Core :: DOM: Events, defect)

Product:
Core
Component:
DOM: Events
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: mak, Unassigned)

References

(
URL
)

Details

I just noticed current Nightly reports a No for Script Execution Events on Html5test, but looks like previous version were reporting Yes.
mozregression info:

Last good revision: 883e17fc475f (2015-04-06)
First bad revision: ab0490972e1e (2015-04-07)
Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=883e17fc475f&tochange=ab0490972e1e

Last good revision: 0613b7a78686
First bad revision: 183190289b9c
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=0613b7a78686&tochange=183190289b9c

Sebastian
OS: Unspecified → All
Hardware: Unspecified → All
Version: unspecified → Trunk
Looks like it's related to CSP, I see blocked messages in the console when the page runs
Blocks: CVE-2015-4490
Flags: needinfo?(mozilla)
You're right. To be specific, the following message relates to the test on html5test.com:

Content Security Policy: The page's settings blocked the loading of a resource at data:text/javascript;charset=utf-8,window ("default-src 'unsafe-inline' *").

This indicates that this is caused by the changes of bug 1086999. The related spec says[1] that the data: scheme is not included in the '*' CSP. So this seems to be rather a bug on html5test.com than in Firefox, as the CSP there looks like this:

default-src 'unsafe-inline' *; frame-src *; options inline-script;

Therefore I filed an issue for html5test.com:

https://github.com/NielsLeenheer/html5test/issues/387

Sebastian

[1] http://www.w3.org/TR/CSP11/#match-source-expression
Flags: needinfo?(mozilla)
Status: NEW → RESOLVED
Closed: 9 years ago
Keywords: regression
Resolution: --- → INVALID
should we move this as an open bug in tech evang?
Ah, I see you filed a bug on github, thanks!
URL: https://github.com/NielsLeenheer/html...
(In reply to Marco Bonardo [::mak] from comment #4)
> should we move this as an open bug in tech evang?

There's already some discussion about that in bug 1086999. You may ask there again.

Sebastian
You need to log in before you can comment on or make changes to this bug.