1277495 - require-sri-for violations should report the blocked subresource, not the document

Status: RESOLVED WONTFIX

(Core :: DOM: Security, defect, P3)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Freddy, can you please provide a link to the code so that someone picking up that bug has a starting point? Thanks!

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #1)
> Freddy, can you please provide a link to the code so that someone picking up
> that bug has a starting point? Thanks!

Sorry, I missed that you assigned it to yourself!

Comment 3

[Frederik Braun [:freddy]]

Attachment: 0001-Bug-1277495-CSP-require-sri-for-log-and-report-corre.patch

This work-in-progress patch gets both URLs (the blocked one as well as the document URL and passes it to logViolationReport).
Unfortunately logViolationReport() always sends a blocked-uri of 'self', which is not useful at all.

This bug needs a fixing of the CASE_CHECK_AND_REPORT macro, before it can be useful.

Comment 4

[Frederik Braun [:freddy]]

Comment 3 said logViolationReport, but the function in question is actually nsCSPContext:LogViolationDetails.

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information

Comment 6

[Frederik Braun [:freddy]]

We've unimplemented require-sri-for