1334158 - Lightbox images CSP error on bug modal

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect, P1)

Description

[Dylan Hardison [:dylan] (he/him)]

img-src needs to include the attachments domain

Comment 1

[Dylan Hardison [:dylan] (he/him)]

Attachment: 1334158_1.patch

Comment 2

[Dylan Hardison [:dylan] (he/him)]

for this, we're adding the attachment base to the img-src rule -- this will always include a trailing slash, does that matter for any reason?

example (from a dev instance): default-src 'self'; child-src 'self' https://ashughes1.github.io/bugzilla-socorro-lens/chart.htm; connect-src 'self' https://brasstacks.mozilla.com/orangefactor/api/count; img-src 'self' https://secure.gravatar.com http://bug888.bugzilla.vm/1334158/; object-src http://bugzilla.vm/1334158/extensions/BugModal/web/ZeroClipboard/ZeroClipboard.swf; script-src 'self' 'nonce-ddQii9uT6Oe8xZquL5NpfEui2u3571tdzeLLnZV6dIAevTOJ' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; form-action 'self' https://www.google.com/search

Comment 3

[April King [:April]]

With CSP, if it has a trailing slash, it is that URL and any URLs underneath it.  If it lacks a trailing slash, then it is only that URL and that URL specifically.

img-src https://www.example.com/images   <-- only a file called images
img-src https://www.example.com/images/  <-- any images inside the images directory

Comment 4

[April King [:April]]

I should add that I believe that these are identical:

img-src https://www.example.com
img-src https://www.example.com/

But I usually only see the first one in practice.

Comment 5

[David Lawrence [:dkl]]

Comment on attachment 8830784 [details] [diff] [review]
1334158_1.patch

Review of attachment 8830784 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 6

[Dylan Hardison [:dylan] (he/him)]

To [e-mail]:mozilla-bteam/bmo.git
   c768148..e320945  master -> master

Comment 7

[David Lawrence [:dkl]]

this change is now live.

dkl