1223743 - (CVE-2016-2816) CSP is not applied to documents sent through multipart/x-mixed-replace

Status: VERIFIED FIXED

(Core :: DOM: Security, defect)

Description

[Muneaki Nishimura]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

Steps to reproduce:

Open the following PoC.
http://mallory.csrf.jp/x-mixed-replace/csp/bad.php



Actual results:

The response from above URL is multipart/x-mixed-replace and it contains two text/html documents in it. Both documents triggers alert(1); and alert(2) from the inline-script. This URL is protected by CSP with default-src 'self' so the inline-script should be ignored but Firefox doesn't.


Expected results:

CSP should be applied to all documents in a multipart/x-mixed-replace response.
The inline script script execution should be ignored like ordinal HTML document (see following URL).
http://mallory.csrf.jp/x-mixed-replace/csp/good.php

Comment 1

[Benjamin Smedberg]

Patrick should this fall under networking or some other layer?

Comment 2

[Patrick McManus [:mcmanus]]

probly networking security.. sworkman would know exactly.

Comment 3

[Steve Workman [:sworkman] (INACTIVE)]

Chris, can you take a look please?

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1223743_csp_not_applied.patch

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1223743_csp_not_applied_tests.patch

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 8695554 [details] [diff] [review]
bug_1223743_csp_not_applied_tests.patch

Review of attachment 8695554 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/security/test/csp/file_multipart_testserver.sjs
@@ +13,5 @@
> +  <img src="file_multipart_testserver.sjs?img" id="testimg"></img>
> +  <script>
> +    var myImg = document.getElementById("testimg");
> +    myImg.onerror = function(e) {
> +      window.parent.postMessage("img-blocked", "*");

This is racy. The image might have already gotten inserted and had it's onerror/onload event fire.

Instead do something like

myImg = new Image;
myImg.src = "...";
myImg.onerror = ...
myImg.onload = ...
document.body.appendChild(myImg);

@@ +30,5 @@
> +  response.setHeader("Cache-Control", "no-cache", false);
> +
> +  if (request.queryString == "doc") {
> +    response.setHeader("Content-Security-Policy", CSP, false);
> +    response.setHeader("Content-Type", "multipart/x-mixed-replace; boundary=" + BOUNDARY, false);

I think this part shouldn't have the '--'. I.e. it should be boundary=fooboundary, not boundary=--fooboundary

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/de7773dd42e1
https://hg.mozilla.org/mozilla-central/rev/31ffab3a0629

Comment 8

[Cornel Ionce [:noni] [Hubs QA]]

Reproduced this issue on 45.0.2.

Confirming the fix on Mac OS X 10.9.5, Ubuntu 12.04x86 and Windows 10x64 using Fx 46.0 RC build 3 (buildID 20160418114253).