1400924 - Site with CSP + web extension with CSP = CSP errors

Status: RESOLVED DUPLICATE of bug 1267027

(WebExtensions :: General, defect, P3)

Description

[:Harald Kirschner :digitarald]

STR

- Install redux devtools: https://addons.mozilla.org/en-US/firefox/addon/remotedev/
- Go to https://js.stripe.com/v3/

ER: Redux debugging

AR:

- CSP errors: Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src https://js.stripe.com”). Source: !function(t){function __webpack_require_....

Could the CSP rules in the addon conflict with the site's rules?

Comment 1

[:Harald Kirschner :digitarald]

Andy, who knows more about the inner workings of CSP rules in extensions?

Comment 2

[Kris Maglione [:kmag]]

(In reply to :Harald Kirschner :digitarald from comment #0)
> Could the CSP rules in the addon conflict with the site's rules?

No. Not unless the add-on changes the site's CSP. The only reason an add-on CSP should apply is if it tries to inject those scripts into one of its own pages.

Comment 3

[Luca Greco [:rpl] [:luca] [:lgreco]]

It is likely to be the opposite: the page CSP could prevent a tag script injected by an extension content scripts to be evaluated (Bug 1267027), based on the page CSP.

In this particular case, it seems to me that the url http://js.stripe.com/v3/ is returning a javascript file and the extension is probably trying to inject a script into the tab where the javascript file has been loaded, which is likely to be what has triggered the CSP error logged.

By inspecting the network request in the network devtools panel related to http://js.stripe.com/v3/ the following is the return CSP http header:

> content-security-policy: "default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com; font-src data: https:; media-src 'none'; object-src 'self';"

Comment 4

[:Harald Kirschner :digitarald]

Forgot to mention, Chrome doesn't exhibit have the issue.

So it is expected that websites can prevent web extensions from injecting JavaScript? Content scripts are fine but if they inject script elements that fails?

Comment 5

[:Harald Kirschner :digitarald]

ni? for question in comment 4

Comment 6

[Kris Maglione [:kmag]]

(In reply to :Harald Kirschner :digitarald from comment #4)
> Forgot to mention, Chrome doesn't exhibit have the issue.
> 
> So it is expected that websites can prevent web extensions from injecting
> JavaScript? Content scripts are fine but if they inject script elements that
> fails?

See bug 1267027.