1297051 - Firefox CSP Report Only blocks mixed content (Video via http)

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Holger Rasmussen]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36

Steps to reproduce:

Visit the following test page:
https://obscure-bastion-11877.herokuapp.com/with-csp


Actual results:

The video referenced via http did not play.  Error:
Content Security Policy: Unsecure request 'http://cdn.ubivent.com/web/test/ubiventimagevideo.webm' is blocked.


Expected results:

The video should be allowed to play as only the header "content-security-policy-report-only" is used. 

content-security-policy-report-only:"block-all-mixed-content; report-uri https://ubivent.report-uri.io/r/default/csp/reportOnly"

A working example without the csp header works:
https://obscure-bastion-11877.herokuapp.com/without-csp

We first detected this Problem in Version 48.

Please note that if both pages (with and without csp) are opened at the same time, both videos will work.  It seems that the video from the page without csp is then reused.  

From our perspective, it seems that the "content-security-policy-report-only" header is also being used as "Content-Security-Policy" header.

We have not tried to see what happens if the "Content-Security-Policy" header is also set.

Comment 1

[Oliver Seuffert]

confirmed in FF49.0b5

Comment 2

[sjw]

I can confirm in current Nightly.

Comment 3

[sjw]

This might be related or a dupe of bug 1249058, but in my case the report-uri is not conspicuously slow.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1297051_csp_ro_block_all_mixed_content_tests.patch

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1297051_csp_ro_block_all_mixed_content.patch

Dan, I just realized we have the same 'report-only' problem for upgrade-insecure-requests - should we fix it within this bug or file a separate one? Would be good to uplift both of them actually. What do you think?

[1] https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPContext.cpp#313

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Holger, thanks for assembling the testpage and filing the bug.

Comment 7

[Holger Rasmussen]

No problem, thanks for fixing the bug so quickly.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 8783938 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content.patch

Review of attachment 8783938 [details] [diff] [review]:
-----------------------------------------------------------------

This works to prevent blocking mixed content in report-only mode, but there's no reporting of it. Actually looks like there's no reporting even in a regular CSP so I guess we should cover that in a separate bug.

r=dveditz

Comment 9

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8783937 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content_tests.patch

Approval Request Comment
When we implemented the CSP directive block-all-mixed-content (landed in FF 48) we didn't account for a CSP enforced in report-only mode. The directive block-all-mixed-content should not be enforced in such a case.

[Feature/regressing bug #]:
Bug 1122236 - Implement block-all-mixed-content CSP directive

[User impact if declined]:
Web pages deploying a CSP in report only mode and use the directive block-all-mixed-content will encounter breakage because all mixed content is blocked.

[Describe test coverage new/current, TreeHerder]:
Land a mochitest within this patch.

[Risks and why]:
Low, since it only affects pages deploying a CSP in report only mode which use the directive block-all-mixed-content.

[String/UUID change made/needed]:
No

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8783938 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content.patch

Approval Request Comment

See comment 9.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/acb05a7c5ee7
CSPRO should not block mixed content. r=dveditz
https://hg.mozilla.org/integration/mozilla-inbound/rev/dc9031025f08
Test CSPRO should not block mixed content. r=dveditz

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking for 49, looks like we should uplift this to beta, but let's make sure it lands on m-c first.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/acb05a7c5ee7
https://hg.mozilla.org/mozilla-central/rev/dc9031025f08

Comment 14

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hello Holger, could you please verify this issue is fixed as expected on a latest Nightly build? Thanks!

Comment 15

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8783937 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content_tests.patch

Test-only patch.

Comment 16

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8783938 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content.patch

Aurora50+

Comment 17

[Holger Rasmussen]

Hi Ritu, yes I can confirm that the issue is fixed with the Nightly build.

Comment 18

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8783938 [details] [diff] [review]
bug_1297051_csp_ro_block_all_mixed_content.patch

Fix for mixed content behavior, verified in nightly. 
This should land for beta 8.

Comment 19

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7773a88b7025
https://hg.mozilla.org/releases/mozilla-aurora/rev/e7145d5a6c29

Comment 20

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-beta/rev/ebaf56c0d767
https://hg.mozilla.org/releases/mozilla-beta/rev/108dd19a4e6b