1391447 - CSP bypass using about URLs

Status: RESOLVED WONTFIX

(Core :: DOM: Security, defect, P3)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Steps to reproduce:

1. Go to https://vuln.shhnjk.com/csp_svg.php
2. Images as well as iframes are loaded.


Actual results:

CSP (default-src 'none') is not enforced to about URLs. And some about URLs are framable or loadable from any website. 


Expected results:

Enforce CSP on about URLs (why is it even framable?)

Comment 1

[Daniel Veditz [:dveditz]]

Only some about: urls are linkable/loadable from web content, and those are all perfectly safe (about:logo and so on). Technically a CSP bypass which we should fix, but about: urls (that are linkable) are all local so no information is leaking to the web through this bypass. We don't need to keep this hidden.

Comment 2

[Daniel Veditz [:dveditz]]

This was explicitly done in bug 1021669 but we don't remember why :-(

https://searchfox.org/mozilla-central/source/dom/security/nsCSPService.cpp#79

Comment 3

[Daniel Veditz [:dveditz]]

(the UI_IS_LOCAL_RESOURCE check is so that add-ons can work -- the spec says to try not to break them)

Comment 4

[Daniel Veditz [:dveditz]]

The only about: urls currently linkable from web content are about:logo and about:blank. The logo isn't really causing any real harm and about:blank is required -- this doesn't seem worth the work to fix at this point.