1247464 - CSP report URIs are not run through the URL classifier

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[François Marier [:francois]]

Attachment: csp-reporturi.html

Steps:

1. Host the attached test page on a web server.
2. Serve it with this CSP header: img-src 'none'; report-uri https://itisatracker.com/csp-report
3. Open that test page in Private Browsing.

Expected:

The report is not sent because the reporting endpoint is on the TP list.

Actual:

The report is sent.

Comment 1

[François Marier [:francois]]

Christoph points to this code:

https://dxr.mozilla.org/mozilla-central/rev/ac39fba33c6daf95b2cda71e588ca18e2eb752ab/dom/security/nsCSPContext.cpp#853-867

Comment 2

[François Marier [:francois]]

Attachment: MozReview Request: Bug 1247464 - Run CSP report URIs through the URL classifier. r?ckerschb

Review commit: https://reviewboard.mozilla.org/r/34667/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/34667/

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8718651 [details]
MozReview Request: Bug 1247464 - Run CSP report URIs through the URL classifier. r?ckerschb

https://reviewboard.mozilla.org/r/34667/#review31347

Looks good to me - thanks!

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cc28ecb2b687

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cc28ecb2b687