1336076 - CSP error while navigating through https://addons.mozilla.org/en-US/firefox/ using Nightly latest

Status: RESOLVED WORKSFORME

(addons.mozilla.org :: Security, defect)

Description

[Valentina Virlics [:vvalentina], VPN QA]

Steps to reproduce:
1. Load https://addons.mozilla.org/en-US/firefox/ page
2. Open Nightly's web console (Ctrl+Shift+K)
3. Navigate trough AMO pages and observe the messages from the console

Expected results:
No errors displayed.

Actual results:
A CSP error regarding the "onfocusin" event is displayed.

Notes/Issues:
Verified on 54.0a1 (2017-02-01) using Windows 7.
Screenshot for this issue: https://www.screencast.com/t/vjN8LjHV

Looks like the bug - https://bugzilla.mozilla.org/show_bug.cgi?id=687787 - has the changes which could have introduced the regression.

[Regression Range]:
Last good revision: 01927ad414ea0925f976b191c2db41a0d0152ae9
First bad revision: aa39c1a962ffa63c1c5017b8c824663dea930771
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=01927ad414ea0925f976b191c2db41a0d0152ae9&tochange=aa39c1a962ffa63c1c5017b8c824663dea930771

Comment 1

[Kevin Wern]

Sorry it took me a while to give a look. I'm not really sure what this means. My impression was that there was some focusin event handler somewhere on the page doing something against the site's CSP (such as using a script outside the specified domains), but I wasn't able to find any such handler. I feel like I'm misinterpreting the meaning of this message somehow.

With CSPUtils log enabled, the terminal outputs (that is relevant to this bug):

> [Main Thread]: D/CSPUtils nsCSPPolicy::allows, aKeyWord: error: invalid keyword in CSP_EnumToKeyword, a  HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPDirective::allows, aKeyWord: error: invalid keyword in CSP_EnumToKeyword, a HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: onfocusin attribute on DIV element
> [Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: onfocusin attribute on DIV element

Nothing I've looked at seems to clarify the "Source: onfocusin attribute on DIV element" message, or others of that template. Olli, do you know anyone who could look into this, or could you give some insight into what this message means?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Sounds like a bug in the page, but I have no idea what the log means.
Perhaps Christoph could help here?

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

So, it seems the page https://addons.mozilla.org/en-US/firefox/ ships with a CSP of [1] and then the following message appears on the console [2]. Looking at the error a little closer it mentions 'Source: onfocusin attribute on DIV element' which is a javascript event handler that gets blocked because script-src does only include a whitelist of sources, but nothing that would allow the inline script to run. Naively one could add 'unsafe-inline' but that would allow *all* scripts to run, even attacker injected script. One solution would be to pinpoint the inline script, hash the script and add the script-hash to the script-src directive.

[1] --- CSP ---
script-src https://ssl.google-analytics.com/ga.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.paypalobjects.com/js/external/dg.js https://addons.cdn.mozilla.net; style-src 'self' 'unsafe-inline' https://addons.cdn.mozilla.net; default-src 'self'; frame-src 'self' https://ic.paypal.com https://paypal.com https://www.google.com/recaptcha/ https://www.paypal.com; child-src 'self' https://ic.paypal.com https://paypal.com https://www.google.com/recaptcha/ https://www.paypal.com; img-src 'self' data: blob: https://www.paypal.com/webapps/checkout/ https://www.paypal.com/webapps/hermes/api/logger https://ssl.google-analytics.com https://addons.cdn.mozilla.net https://static.addons.mozilla.net https://sentry.prod.mozaws.net; media-src https://videos.cdn.mozilla.net; object-src 'none'; connect-src 'self' https://sentry.prod.mozaws.net; font-src 'self' https://addons.cdn.mozilla.net; form-action 'self' https://developer.mozilla.org; base-uri 'self' https://addons.mozilla.org; report-uri /__cspreport__

[2] --- Console Error ---
Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src https://ssl.google-analytics.com/ga.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.paypalobjects.com/js/external/dg.js https://addons.cdn.mozilla.net”). Source: onfocusin attribute on DIV element.

Comment 4

[Daniel Veditz [:dveditz]]

This is a bug in the site, not Firefox. The reason there's a regression range is because before the feature was implemented we ignored that element -- but the site was broken all along if they have a CSP that says "no inline scripts" and a page that has inline scripts.

I've moved this over to the addons.mozilla.org product, but I think all their actual bugs have moved to github somewhere.

Comment 5

[Stuart Colville [:muffinresearch]]

This is caused by JQuery which apparently is running some code to detect support. In the process of doing this it's violating the CSP.

Comment 6

[Jeroen Pulles]

Now Firefox 52 has hit the streets I'm seeing this CSP error on lots of sites. 

Before Firefox 52, or Valentina's nightly from a month ago, there was no CSP logging for this jQuery 1.x test; on an element that is not attached to the DOM. 

It's an unfortunate combination of any site running latest Firefox, jQuery 1.x and a sane CSP;
As far as I can see I have no other option than patching jQuery 1.x to change their test:

https://github.com/jquery/jquery/blob/1.12-stable/src/event/support.js#L17

`'focusin' in window` evaluates to false; 
`document.documentElement.onfocusin` is undefined... 

Am I right when I deduce from the above changeset that these focus in/out events only exist in Firefox UI, and not in an ordinary HTML page?

Comment 7

[Julien Cristau [:jcristau]]

Mass wontfix for bugs affecting firefox 52.

Comment 8

[Andreas Wagner [:TheOne] [use NI]]

I don't think we're using jQuery 1.x anymore. I also no longer see this error in the web console. Can we close this bug?

Comment 9

[Alexandra Moga [:LexaSV]]

I have navigated both on the new frontend version of https://addons.mozilla.org/ and on pages supported only by the legacy site and the error reported above was no longer displayed in the console.

Marking the issue as verified fixed on Firefox 64, Win10x64