1277248 - Add test to ensure that CSP require-sri-for blocks <svg:script>

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Frederik Braun [:freddy]]

Attachment: test_svg.php

svg:script doesn't technically know about Subresource Integrity, according to https://github.com/w3c/webappsec/issues/396

This bug is to investigate if this is a potential CSP |require-sri-for| bypass and add a test case to ensure it isn't.

But so far, my local testing can not make svg:script work with the CSP set.

I have a naive PHP test attached (yet to become a mochitest).

Comment 1

[Frederik Braun [:freddy]]

This /could/ be a good first bug.

Comment 2

[Frederik Braun [:freddy]]

Attachment: Bug 1277248: add test to ensure that require-sri-for does not allow svg:scripts

Review commit: https://reviewboard.mozilla.org/r/78352/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/78352/

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8790639 [details]
Bug 1277248: add test to ensure that require-sri-for does not allow svg:scripts

https://reviewboard.mozilla.org/r/78352/#review76936

lgtm,r=me and thanks!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d434f479d145
Add test to ensure that require-sri-for does not allow svg:scripts r=ckerschb

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d434f479d145