1294587 - The CSP feature is broken

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

Writing:

Bugzilla->cgi->content_security_policy(font_src => ["none"])

throws:

Odd number of elements in hash assignment at Bugzilla/CGI.pm line 118.
Found unknown attribute(s) passed to the constructor: Bugzilla::CGI=HASH(0x7c81d8)
        Bugzilla::CGI::ContentSecurityPolicy::new("Bugzilla::CGI::ContentSecurityPolicy", "style_src", ARRAY(0x2a34528), "Bugzilla::CGI=HASH(0x7c81d8)", "font_src", "default_src", ARRAY(0x2a34660), "script_src", ARRAY(0x2a344b0), ...) called at Bugzilla/CGI.pm line 128
        Bugzilla::CGI::content_security_policy(Bugzilla::CGI=HASH(0x7c81d8), "font_src", ARRAY(0x7c86b8))


This is because the code in Bugzilla::CGI::content_security_policy() is wrong:

sub content_security_policy {
    my ($self) = @_;

It must be: my $self = shift; else $self is passed to %add_params. dkl already reported this problem in his review, see bug 1286287 comment 4. But his review comments have been ignored.

Comment 1

[Dylan Hardison [:dylan] (he/him)]

Attachment: 1294587_1.patch

gah, I didn't commit the version that actually let you change the policy.

Comment 2

[David Lawrence [:dkl]]

Comment on attachment 8780343 [details] [diff] [review]
1294587_1.patch

Review of attachment 8780343 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 3

[Dylan Hardison [:dylan] (he/him)]

To github.com:bugzilla/bugzilla.git
   1947079..b9c4001  master -> master