1299604 - Incorrect behavior of Subresource Integrity when Sandbox attribute present

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Eric Lawrence (@ericlaw)]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.80 Safari/537.36

Steps to reproduce:

Visit https://bayden.com/test/sri/ in Chrome 55 and Firefox 51.


Actual results:

Stylesheet applied in Firefox but not in Chrome.


Expected results:

In Chrome, the stylesheet application is blocked because the LINK element did not specify crossorigin="anonymous". Though the CSS resource is normally same-origin to the page in the same folder, the SANDBOX attribute in the page's CSP declaration means that it should not be treated as such.

See also https://crbug.com/642744

Comment 1

[Emil Pasca [:emilpasca]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0

I have tested this issue on Windows 10 x64 with the latest Firefox release (48.0.2) and the latest Nightly (51.0a1-20160904030201) and managed to reproduce it.
After loading the URL provided in the STR form the description, you can observe that the stylesheet is applied and the text is colored red.

Comment 2

[François Marier [:francois]]

We'll need to re-test this once bug 1187335 lands because the test for whether or not something is same-origin has changed.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

It seems Bug 1187335 has fixed the issue described in this bug. When running the STR from comment 0, the text is not styled and I see the following error in the console:

> “https://bayden.com/test/sri/styles.css” is not eligible for integrity checks since it’s neither CORS-enabled nor same-origin.

Comment 4

[François Marier [:francois]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #3)
> It seems Bug 1187335 has fixed the issue described in this bug. When running
> the STR from comment 0, the text is not styled and I see the following error
> in the console:
> 
> > “https://bayden.com/test/sri/styles.css” is not eligible for integrity checks since it’s neither CORS-enabled nor same-origin.

Great!

Comment 5

[Devdatta Akhawe [:devd]]

awesome! thanks.