1418236 - CSP violation event target

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Chung-Sheng Fu [:cfu]]

In bug 1037335, we introduced a basic implementation of CSP violation event, which is fired to the policy's loading document.  We are going to update how the event target is determined according to the latest standard.

https://w3c.github.io/webappsec-csp/#report-violation

Comment 1

[Andrea Marchesini [:baku]]

Attachment: csp_target.patch

Still waiting for a full green result...

Comment 2

[Andrea Marchesini [:baku]]

Comment on attachment 8989805 [details] [diff] [review]
csp_target.patch

This doesn't fix a corner case:

var iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.src = "javascript:something";

in theory, iframe should be the target for the CSP violation event, but we still send events to the document.
I know why, but I need to talk with bz to find the correct way to fix this issue.
Follow up.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Andrea Marchesini [:baku] from comment #2)
> Comment on attachment 8989805 [details] [diff] [review]
> csp_target.patch
> 
> This doesn't fix a corner case:
> 
> var iframe = document.createElement('iframe');
> document.body.appendChild(iframe);
> iframe.src = "javascript:something";
> 
> in theory, iframe should be the target for the CSP violation event, but we
> still send events to the document.
> I know why, but I need to talk with bz to find the correct way to fix this
> issue.
> Follow up.

As discussed on IRC, the follow up is Bug 1473630.

Comment 4

[Andrea Marchesini [:baku]]

Attachment: csp_target.patch

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8990985 [details] [diff] [review]
csp_target.patch

Review of attachment 8990985 [details] [diff] [review]:
-----------------------------------------------------------------

Passing the triggeringElement around sounds good to me. r=me

PS: Probably you want to update the commit message.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b3143e4ec83
Correct EventTarget for CSP violation events, r=ckerschb

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/1b3143e4ec83