1255798 - Block all non-https loads for remote newtab

Status: NEW

(Core :: DOM: Security, defect)

Description

[Franziskus Kiefer [:franziskus]]

We should make sure that the remote about:newtab does not load over non-https channels, i.e. no http, no ftp etc.

Background: we have to obviously use https, but we enforce content signatures only on http(s) channels, hence any other type of load is not secured.

Comment 1

[Tanvi Vyas[:tanvi]]

Great use case for the newly implemented block all mixed content csp directive that Christoph landed!
https://bugzilla.mozilla.org/show_bug.cgi?id=1122236

Comment 2

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Tanvi Vyas - please needinfo [:tanvi] from comment #1)
> Great use case for the newly implemented block all mixed content csp
> directive that Christoph landed!
> https://bugzilla.mozilla.org/show_bug.cgi?id=1122236

The CSP for about:newtab should definitely use 'block-all-mixed-content'. But I think we need a little more for about:newtab, because the main page should only load if it's https, right? CSP and mixedContentBlocker bail early for TYPE_DOCUMENT. So we still need to make sure that happens.