1329198 - Issue with Google Chrome CSP evaluation of child-src

Status: UNCONFIRMED

(Core :: DOM: Security, defect, P3)

Description

[Antonio Sanso]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161208153507

Steps to reproduce:

There in issue with Google Chrome CSP evaluation of child-src and javascript: pseudo URI.

Instant demo http://asanso.github.io/csp-nonce/iframe.html


Actual results:

javascript was executed


Expected results:

i would have expected csp to block this

Comment 1

[Daniel Veditz [:dveditz]]

Are you filing a bug about Chrome, or Firefox? They seem to behave the same so maybe the specification is wrong or ambiguous. Javascript is executed in the parent document, not loaded in the frame, and is controlled by the script-src settings. If you've also filed a bug in the chrome bug tracker it would be helpful to paste the link here so we can coordinate with them.

Our code explicitly allows javascript: in these cases (returns false below) so that the script rules can take precedence
https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPService.cpp#96

I believe we should NOT check the URI_INHERITS_SECURITY_CONTEXT flag here because that will allow other unknown protocols to also slip through (should an add-on create one -- unlikely!). Javascript gets special CSP handling for good or ill, and we should explicitly check for that scheme rather than generically.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> I believe we should NOT check the URI_INHERITS_SECURITY_CONTEXT flag here
> because that will allow other unknown protocols to also slip through (should
> an add-on create one -- unlikely!). Javascript gets special CSP handling for
> good or ill, and we should explicitly check for that scheme rather than
> generically.

I discussed things with Dan and I agree with his comment, I also filed Bug 1330035.

Comment 3

[Antonio Sanso]

Chrome bug is https://bugs.chromium.org/p/chromium/issues/detail?id=678932 .
According to it this is not an issue but is CSP spec compliant.
Sorry I probably got confused by the presence of 'unsafe-inline' in the documentation (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src).