Closed Bug 1389877 Opened 7 years ago Closed 7 years ago

Content-Security-Policy leak the base URL of some unrelated tabs

Categories

(Core :: DOM: Security, defect)

Product:
Core
Component:
DOM: Security
Version:
57 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1384741

People

(Reporter: bugs, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20170812100345

Steps to reproduce:

1) Have a website.
2) Add this CSP header to the web server:
```
add_header Content-Security-Policy "default-src 'unsafe-inline' data:; report-uri /report-csp-violation" always;
```
3) Open many tabs in Firefox, I currently have about 560 of them opened, including some hundred actually loaded.
4) Visit this website using Firefox nightly (tested on 57.0a1 (2017-08-12) (64-bit), and 2017-08-08).


Actual results:

The POST URL received about ten requests containing the base URL of some of the domains I have in open tabs.

If I add https: to the default-src, I get fewer domains (only the ones in http:), and if I also add http: I get none.

You can test this on https://movim.jabberfr.org/ where the CSP header contains more directives, but the result is the same.

These requests don’t even appear in the network console, which means users will have a very hard time seeing the bug, Wireshark or similar tools will be required.


Expected results:

No leak should happen.
Do you have stylo/servo enabled (check the value of layout.css.servo.enabled in about:config ) and is this fixed on today's nightly? If so, I expect this is a duplicate of bug 1384741.
Flags: needinfo?(bugs)
Group: firefox-core-security → core-security
Component: Untriaged → DOM: Security
Product: Firefox → Core
Group: core-security → dom-core-security
Heycam: do you agree this is a dupe of bug 1384741?
Flags: needinfo?(cam)
Yes, that sounds like bug 1384741, which landed the day after the build mentioned in comment 0.
Flags: needinfo?(cam)
I indeed have this property set, and I can’t reproduce anymore on master, thanks for fixing it. :)
Status: UNCONFIRMED → RESOLVED
Closed: 7 years ago
Flags: needinfo?(bugs)
Resolution: --- → DUPLICATE
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.