1457513 - Don't lie about CSP header

Status: RESOLVED FIXED

(DevTools :: JSON Viewer, defect)

Description

[Oriol Brufau [:Oriol]]

1. Load https://api.github.com/
2. Go to Headers tab

You can see this header:
  Content-Security-Policy:  default-src 'none' ; script-src resource:;

But the server sent this instead:
  Content-Security-Policy:  default-src 'none'

Regressed by https://hg.mozilla.org/mozilla-central/rev/38f15c3991f9

If the header needs to be modified, then this should happen after storing original headers.

Comment 1

[Oriol Brufau [:Oriol]]

Attachment: Bug 1457513 - Let JSON Viewer display unmodified headers

Review commit: https://reviewboard.mozilla.org/r/240424/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/240424/

Comment 2

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Comment on attachment 8971656 [details]
Bug 1457513 - Let JSON Viewer display unmodified headers

https://reviewboard.mozilla.org/r/240424/#review246378

Thanks for the patch & test, looks good to me!

R+ assuming try is green.

Honza

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2d72766be0b3
Let JSON Viewer display unmodified headers r=Honza

Comment 4

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/2d72766be0b3

Comment 5

[Oriol Brufau [:Oriol]]

esr60 seems affected, https://hg.mozilla.org/releases/mozilla-esr60/file/tip/devtools/client/jsonview/converter-child.js#l88

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Too late for 60. I'm not convinced we need to uplift this to ESR60 either, but I'd entertain an argument.

Comment 7

[Julien Cristau [:jcristau]]

I'm with Ryan on this one.