1439425 - Content Security Policy: Couldn’t process unknown directive ‘’

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Scott Helme]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce:

Create a CSP that only contains ";". Here is the Nginx config:

    add_header Content-Security-Policy ";" always;



Actual results:

Console error message:

Content Security Policy: Couldn’t process unknown directive ‘’


Expected results:

Either a more useful warning, like 'the policy is invalid/empty', or no warning which is Chrome's behaviour.

Comment 1

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 1439425 - Ignore empty CSP directives.

Review commit: https://reviewboard.mozilla.org/r/225650/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/225650/

Comment 2

[Jonathan Kingston [:jkt] he/him]

Some CSPParser tests are failing on try, looking into why also a http-equiv wpt test too: https://treeherder.mozilla.org/#/jobs?repo=try&revision=afb13e7e08de14b31f0cbeb303545062fc4b247b&selectedJob=166387326

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8956690 [details]
Bug 1439425 - Ignore empty CSP directives.

https://reviewboard.mozilla.org/r/225650/#review231666

a little hacky but good enough for me. thanks for picking this up jkt!

Comment 4

[Jonathan Kingston [:jkt] he/him]

Comment on attachment 8956690 [details]
Bug 1439425 - Ignore empty CSP directives.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/225650/diff/1-2/

Comment 5

[Jonathan Kingston [:jkt] he/him]

:ckerschb reviewboard still is giving me an r+. However I also made sure the value is empty as it was failing some tests and to make it less hacky. I'd appreciate you to check it over before I land it.
Thanks!

Comment 6

[Jonathan Kingston [:jkt] he/him]

Try run: https://treeherder.mozilla.org/#/jobs?repo=try&revision=de75e50e07214c7c06f7963a0d784c61f3a2eefb

Comment 7

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Jonathan Kingston [:jkt] (on PTO) from comment #5)
> :ckerschb reviewboard still is giving me an r+. However I also made sure the
> value is empty as it was failing some tests and to make it less hacky. I'd
> appreciate you to check it over before I land it.


Where to we actually log to the console now? Shouldn't that happen here?
https://hg.mozilla.org/try/rev/a91e98bbc53c172cfee976bfa6c899fe4439e52b#l1.12

Comment 8

[Jonathan Kingston [:jkt] he/him]

Sorry, I didn't understand.

I moved the check into a function call to make it cleaner. I also moved the code into the directive code which is earlier in the call stack as it involves both key and value data which seemed to belong there rather than directive name.
I don't think we should be ever logging for invalid consoles right?

Comment 9

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Jonathan Kingston [:jkt] (on PTO) from comment #8)
> Sorry, I didn't understand.
> 
> I moved the check into a function call to make it cleaner. I also moved the
> code into the directive code which is earlier in the call stack as it
> involves both key and value data which seemed to belong there rather than
> directive name.
> I don't think we should be ever logging for invalid consoles right?

Ah, that makes the most sense to me. The check happens earlier so we are not logging to the console at all. thanks!

r+

Comment 10

[Jonathan Kingston [:jkt] he/him]

Comment on attachment 8956690 [details]
Bug 1439425 - Ignore empty CSP directives.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/225650/diff/2-3/

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cfe09d016e77
Ignore empty CSP directives. r=ckerschb

Comment 12

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/cfe09d016e77