1517301 - A CSP error shouldn't be triggered for form-action if the submission has been canceled by JS

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Julien Wajsberg [:julienw]]

Attachment: testcase-csp-form.html

STR:
1. Load the attached file.
2. Press the button.

=> Notice there's an error in the console despite the fact that `preventDefault` is called in the JS handler for the "submit" event.
Note that this doesn't happen in Chrome.

Comment 1

[Julien Wajsberg [:julienw]]

(Note: Bugzilla adds its own CSP header, so the results are a bit different when loaded from bugzilla's domain, but the error is still displayed)

Comment 2

[Daniel Veditz [:dveditz]]

We may be checking this twice (when nsHTMLFormElement::GetActionURL is called) in which case this is just an annoying extra error. But it's possible we're checking too early which might give the JS event a chance to change the form-action from a valid destination to a CSP-bypassing one.

Comment 3

[Daniel Veditz [:dveditz]]

jkt to test to make sure there's no CSP bypass. If not this could be P3, if there is we should mark this as a security bug and make it a P2.

Comment 4

[Jonathan Kingston [:jkt] he/him]

I wasn't able to make a CSP bypass whilst the event handler fires so it seems that we are double checking the URL when perhaps we shouldn't need to be. Maybe I should add a check for this to my patch though.

Comment 5

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 1517301 - Move CSP check for form-action to be within HTMLFormSubmission to prevent checking before the form should be submitted. r?ckerschb

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/45bb6ff923e9
Move CSP check for form-action to be within HTMLFormSubmission to prevent checking before the form should be submitted. r=ckerschb,smaug

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/14779 for changes under testing/web-platform/tests

Comment 8

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/45bb6ff923e9