1409728 - CSP reports do not conform to spec

Status: RESOLVED DUPLICATE of bug 1204991

(Core :: DOM: Security, defect)

Description

[Scott Helme]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36

Steps to reproduce:

When a CSP report is delivered the original-policy value is not populated correctly.

The spec states that the content of original-policy should be "The original policy, as received by the user agent."

https://www.w3.org/TR/CSP2/#violation-report-original-policy

1) Deploy a CSP with reporting that uses the 'self' keyword on a page.
2) Cause a violation of that CSP and a report to be sent. 
3) The original-policy value of the report is not spec compliant.


Actual results:

The browser is substituting the 'self' keyword with the URL in the original-policy field of the report.

If we deploy the following policy on scotthelme.co.uk:

Content-Security-Policy: default-src 'self'; report-uri https://report-uri.io

The original-policy field in reports should contain:
default-src 'self'; report-uri https://report-uri.io

The original-policy field in reports actually contains:
default-src https://scotthelme.co.uk/; report-uri https://report-uri.io



Expected results:

The browser should return the original policy in the original-policy field without modification as per the specification.

Comment 1

[Christoph Kerschbaumer [:ckerschb, back on Aug 10th}]

Thanks Scott for reporting. In fact you already filed a very similar bug (see Bug 1204991) two years ago and we still haven't fixed it yet. Even though it's not entirely the same, it's close enough to mark this as a duplicate. Hopefully I can find someone to pick up that work soonish.

Comment 2

[Scott Helme]

Yeah I guess the fix for one will fix the other if you include the original policy in the report verbatim. 

Happy to close as dupe then.