1491825 - implement MOZ_LOG for content security checks (log topic "CSMLog")

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P2)

Description

[Frederik Braun [:freddy]]

The goal of this bug is to allow easier debugging of content security checks, by adding lots of MOZ_LOG calls to `nsContentSecurityManager::doContentSecurityCheck`.

I've started off with a patch from ckerschb, that shows numerous information. Namely:
- channel URI
- loadingPrincipal
- triggeringPrincipal
- principal to be inherited
- various load flags from loadinfo

One might also consider adding a toString() for the loadinfo, instead of getting flags individually, but I'll submit a patch to discuss before diving much deeper.

The first patch prints for httpchannels only with log level 4 (debug), but includes all other channels with a log level 5 (verbose).

Comment 1

[Frederik Braun [:freddy]]

Attachment: Bug 1491825: add MOZ_LOG for content security checks

This patch adds a new log module 'CSMLog' for checks in nsContentSecurityManager::doContentSecurityCheck.

With log level 4 (debug) only HTTP URLs will be logged. Level 5 (verbose) logs for all loads.

The logger shows the following information: - channel URI - loadingPrincipal - triggeringPrincipal - principal to be inherited - load flags from loadinfo

Comment 2

[Jonathan Kingston [:jkt] he/him]

Comment on attachment 9009867 [details]
Bug 1491825: add MOZ_LOG for content security checks

Jonathan Kingston [:jkt] has approved the revision.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 9009867 [details]
Bug 1491825: add MOZ_LOG for content security checks

Christoph Kerschbaumer [:ckerschb] has approved the revision.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/bec29f2634a5
add MOZ_LOG for content security checks r=ckerschb

Comment 5

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/bec29f2634a5

Comment 6

[Chris Mills [:cmills]]

Just to check, what web developer-facing features does this add, that need to be documented on MDN? Thanks!

Comment 7

[Frederik Braun [:freddy]]

The documentation that needs updating with this bug would be <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Gecko_Logging>, but that isn't targeting web developers, mostly.
Is dev-doc-needed only for documentation targeting web developers?

Comment 8

[Chris Mills [:cmills]]

(In reply to Frederik Braun [:freddyb] from comment #7)
> The documentation that needs updating with this bug would be
> <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/
> Gecko_Logging>, but that isn't targeting web developers, mostly.
> Is dev-doc-needed only for documentation targeting web developers?

These days, the focus of the MDN team is basically just web platform documentation; we don't tend to do platform stuff any more as we just don't have the capacity. I can help out on small updates, if you let me know what needs adding, or I'd also be happy to review additions made by engineering.

Comment 9

[Frederik Braun [:freddy]]

Thanks for the clarification, Chris!
I'm removing the flag.