1476280 - SecurityPolicyViolationEvent.blockedURI should contain the original URL in case of redirects

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement)

Description

[Andrea Marchesini [:baku]]

We current report the final URL. This doesn't follow the CSP3 spec.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: part 1 - redirect

Comment 2

[Andrea Marchesini [:baku]]

Attachment: part 2 - no cache

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8992634 [details] [diff] [review]
part 2 - no cache

Review of attachment 8992634 [details] [diff] [review]:
-----------------------------------------------------------------

r+ on that cache removal which has become outdated for quite some time now and doesn't really buy us anything. thanks!

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8992632 [details] [diff] [review]
part 1 - redirect

Review of attachment 8992632 [details] [diff] [review]:
-----------------------------------------------------------------

please incorporate my nit and r=me

::: dom/security/nsCSPContext.cpp
@@ +95,5 @@
> +BlockedContentSourceToString(nsCSPContext::BlockedContentSource aSource,
> +                             nsACString& aString)
> +{
> +  switch (aSource) {
> +    case nsCSPContext::BlockedContentSource::eUnknown:

I think it would be better to move eUnkown to the bottom with a fall through to default: to make sure in case someone extends the enum but does not update that code correctly, it fails/truncates by default.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/11e3d3bd2328
SecurityPolicyViolationEvent.blockedURI should contain the original URL in case of redirects, r=ckerschb

Comment 6

[Andrea Marchesini [:baku]]

The cache patch is going to land in a separate bug. See bug 1476592

Comment 7

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/12062 for changes under testing/web-platform/tests

Comment 8

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/11e3d3bd2328

Comment 9

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged