1474537 - CSP 'self' should translate to 'self' and not be resolved to actual self URI

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P1)

Description

[Christoph Kerschbaumer [:ckerschb]]

Currently we are not strictly spec compliant when returning the 'original-policy' in csp reports, because instead of 'self' we return https://foo.com' in case the page is hosted on foo.com.

Instead we should return 'self' whenever 'self' appears in the policy.

This is also needed within Bug 965637 where we need to serialize the CSP.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1474537_csp_self_translate_self.patch

Hey Dan, please see comment 0 for explanation of the change here - This change actually makes us more spec compliant and fixes a bunch of web platform tests.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=32533dbbaeb66c190c6552ea7c09d61b56bf3aa1

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 8990932 [details] [diff] [review]
bug_1474537_csp_self_translate_self.patch

Review of attachment 8990932 [details] [diff] [review]:
-----------------------------------------------------------------

Looks great, r=dveditz

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/113b601a3b59
CSP 'self' should translate to 'self' and not be resolved to actual self URI. r=dveditz

Comment 5

[Andreea Pavel [:apavel]]

Backed out for failing mochitest and wpt 

Push that started the failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=4fbeea69b10d7487b74de22de78065d5b326dca5

Failure logs: https://treeherder.mozilla.org/logviewer.html#?job_id=189130132&repo=mozilla-inbound&lineNumber=3535
https://treeherder.mozilla.org/logviewer.html#?job_id=189130548&repo=mozilla-inbound&lineNumber=7047

Backout: https://hg.mozilla.org/integration/mozilla-inbound/rev/3539fcf9699308a1a05d5cec055321bb1220b0d5

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

This patch got pushed together with Bug 1475073 which caused a test failure, see:
https://bugzilla.mozilla.org/show_bug.cgi?id=1475073#c11

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/91f5766f581b
CSP 'self' should translate to 'self' and not be resolved to actual self URI. r=dveditz

Comment 8

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/91f5766f581b