1330035 - Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP()

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Christoph Kerschbaumer [:ckerschb]]

As discussed with Dan, we should not use URI_INHERITS_SECURITY_CONTEXT but rather use javascript: explictly, see:

https://bugzilla.mozilla.org/show_bug.cgi?id=1329198#c1

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1330035_explicitly_use_javascript.patch

Comment 2

[Daniel Veditz [:dveditz]]

Comment on attachment 8825726 [details] [diff] [review]
bug_1330035_explicitly_use_javascript.patch

Review of attachment 8825726 [details] [diff] [review]:
-----------------------------------------------------------------

r=dveditz

::: dom/security/nsCSPService.cpp
@@ +73,5 @@
>    if (NS_SUCCEEDED(rv) && match) {
>      return true;
>    }
> +  // finally we have to whitelist "about:" and "javascript:" which do
> +  // not fall into the category underneath but are not subject to CSP.

maybe "not subject to CSP content loading rules"? "javascript:" _is_ subject to CSP of course, but the script rules instead.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4a1f0be6fa1d
Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP(). r=dveditz

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4a1f0be6fa1d