1449246 - CSP shows error about attribute removed through sanitizer before actually appending to DOM

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[:Gijs (he/him)]

STR:

0. disable e10s for ease of debugging
1. open about:reader
2. open browser console
3. run:

parserUtils = Cc["@mozilla.org/parserutils;1"].getService(Ci.nsIParserUtils); parserUtils.parseFragment("<div onclick='alert(`hi`)'></div>",
      Ci.nsIParserUtils.SanitizerDropForms | Ci.nsIParserUtils.SanitizerAllowStyle,
      false, null, content.document.body);


ER:

you get a div with no attributes and no CSP errors

AR:
you get a div with no attributes AND you get a CSP error.

Comment 1

[:Gijs (he/him)]

(In reply to :Gijs from comment #0)
> STR:
> 
> 0. disable e10s for ease of debugging
> 1. open about:reader

Err, this requires opening an article (e.g. http://www.bbc.co.uk/news/science-environment-43518365 ) and then entering reader mode. Apologies for the confusion.