1529337 - Implement CSP 'script-src-elem' and 'script-src-attr' directives

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Daniel Veditz [:dveditz]]

CSP 3 adds two new directives that supersede the script-src directive. These must be honored if present, with a fallback to script-src only if they are not.

script-src-elem specifically for <script> elements
https://w3c.github.io/webappsec-csp/#directive-script-src-elem

script-src-attr specifically for event handler attributes
https://w3c.github.io/webappsec-csp/#directive-script-src-attr

The major motivation for these appears to be so 'unsafe-inline' or 'unsafe-eval' can be allowed for the attribute one which can't support a nonce without blowing a hole everywhere else.

Comment 1

[mustafaoncel92]

There is 2 years from last update. When will it will be supported on Firefox?

Comment 2

[Maxwell Snyder]

It's been another year and I'm wondering, is it supported in Firefox yet?

Comment 3

[Dennis Schubert [:denschub]]

The WebCompat issue got fixed, so removing the WebCompat priority flag as we have no further evidence of this breaking the real world.

Comment 4

[Tom Schuster (MoCo)]

Attachment: Bug 1529337 - Implement CSP 'script-src-elem' and 'script-src-attr' directives. r?freddyb

Comment 5

[Tom Schuster (MoCo)]

Attachment: Bug 1529337 - Use script-src-elem/attr as effectiveDirective in CSP reports. r?freddyb

Depends on D150965

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f1489d7cf1a1
Implement CSP 'script-src-elem' and 'script-src-attr' directives. r=freddyb,webidl,smaug
https://hg.mozilla.org/integration/autoland/rev/12cd014c46e8
Use script-src-elem/attr as effectiveDirective in CSP reports. r=freddyb

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f1489d7cf1a1
https://hg.mozilla.org/mozilla-central/rev/12cd014c46e8

Comment 8

[Sandor Molnar[:smolnar]]

Backed out for awaiting decision on implementing other CSP 3 features

Backout link: https://hg.mozilla.org/integration/autoland/rev/a1bee21f1624f6fb220522f89a4d5cd38e0e6415

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cb20674f1b07
Implement CSP 'script-src-elem' and 'script-src-attr' directives. r=freddyb,webidl,smaug,dveditz
https://hg.mozilla.org/integration/autoland/rev/70b37777bc92
Use script-src-elem/attr as effectiveDirective in CSP reports. r=freddyb,dveditz

Comment 10

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/cb20674f1b07
https://hg.mozilla.org/mozilla-central/rev/70b37777bc92

Comment 11

[Hamish Willee]

FYI Docs work for this can be tracked here: https://github.com/mdn/content/issues/20878

In this case pretty much just browser compatibility update and addition to experimental features page.