1497197 - Apply Meta CSP to about:debugging

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1497197_csp_about_debugging.patch

Comment 2

[:Gijs (he/him)]

Comment on attachment 9017074 [details] [diff] [review]
bug_1497197_csp_about_debugging.patch

Review of attachment 9017074 [details] [diff] [review]:
-----------------------------------------------------------------

Someone who knows about:debugging should review this.

Comment 3

[Julian Descottes [:jdescottes]]

Comment on attachment 9017074 [details] [diff] [review]
bug_1497197_csp_about_debugging.patch

Looks good to me. We are planning to switch to a new about:debugging UI soon. Do you want to apply the same fix to devtools/client/aboutdebugging-new/index.html or  should I log a separate bug?

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Julian Descottes [:jdescottes][:julian] from comment #3)
> Looks good to me. We are planning to switch to a new about:debugging UI
> soon. Do you want to apply the same fix to
> devtools/client/aboutdebugging-new/index.html or  should I log a separate
> bug?

We need a separate bug for that and remove the inline script, put and package it in an external file and load all of the JS [1] using a chrome: URL. Otherwise we would have to use 'unsafe-inline' in the CSP, and we are adding a CSP exactly to prevent inline script execution :-)

[1] https://searchfox.org/mozilla-central/source/devtools/client/aboutdebugging-new/index.html#10-20

Comment 5

[Julian Descottes [:jdescottes]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #4)
> (In reply to Julian Descottes [:jdescottes][:julian] from comment #3)
> > Looks good to me. We are planning to switch to a new about:debugging UI
> > soon. Do you want to apply the same fix to
> > devtools/client/aboutdebugging-new/index.html or  should I log a separate
> > bug?
> 
> We need a separate bug for that and remove the inline script, put and
> package it in an external file and load all of the JS [1] using a chrome:
> URL. Otherwise we would have to use 'unsafe-inline' in the CSP, and we are
> adding a CSP exactly to prevent inline script execution :-)
> 
> [1]
> https://searchfox.org/mozilla-central/source/devtools/client/aboutdebugging-
> new/index.html#10-20

Ahah good point. Filed Bug 1499064, will address it later today.

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

We should land those changes here together with the changes within Bug 1499064.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:ckerschb, could you have a look please?

Comment 8

[Christoph Kerschbaumer [:ckerschb]]

Before we can apply CSP to system privileged about pages we have to fix Bug 965637, in which we move the CSP from the Principal into the Client. Please note that the Meta Bug 1492063 for applying CSP to system privileged about: pages is blocked by 965637. At the moment we are fixing the last remaining blockers and as soon as we have landed Bug 965637 I'll try to land all the dependencies of Bug 1492063 so we end up having all about: pages secured by a CSP.

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1497197: Apply Meta CSP to about:debugging. r=jdescottes

Comment 11

[Christoph Kerschbaumer [:ckerschb]]

Hey Julian, I added a CSP to the 'old' and the 'new' about:debugging page (from Bug 1499064). The old version you already reviewed here a while ago. Could you please rubber stamp that again? Thanks!

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e97f23bfa99c
Apply Meta CSP to about:debugging. r=jdescottes

Comment 13

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7d105b9c1589
Backed out changeset e97f23bfa99c for devtools failures in devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_profiler_dialog.js

Comment 14

[Julian Descottes [:jdescottes]]

Two things:

• we have test failures because we are using data urls in some tests. :gijs already has a fix for this in scope of bug 1560178
• I noticed that all images with data URLs as src are now empty

The first issue is not a big concern. But the second issue is much more problematic. Is there a way we can keep using data URL as image sources here?

For instance, would

<meta http-equiv="Content-Security-Policy" 
      content="default-src chrome: resource:; img-src data: chrome: resource:" />

be acceptable here?

Comment 15

[Christoph Kerschbaumer [:ckerschb]]

It seems there are some test updates that happen within Bug 1560178. We just wait for those and then land with a CSP of:
<meta http-equiv="Content-Security-Policy"
content="default-src chrome: resource:; img-src data: chrome: resource:" />

Opening up the CSP to allow data: for images is totally fine.

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2c7ddea7649e
Apply Meta CSP to about:debugging. r=jdescottes

Comment 17

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/2c7ddea7649e