1532207 - Check if OverridesCSP check from Bug 1529877 can be moved to frame->GetSrcTriggeringPrincipal()

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P2)

Description

[Christoph Kerschbaumer [:ckerschb]]

As a follow up to Bug 1529877 we should check if we can move the OverrideCSP() check from nsFrameLoader.cpp into frame->GetSrcTriggeringPrincipal() and just not store the triggeringPrincipal in that case at all, so that we always fall back to using the node->NodePrincipal.

Comment 1

[Kris Maglione [:kmag]]

I think we really want to just do this check before we store the triggering principal at all, from GetAttrTriggeringPrincipal1.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=12a099822bd238d1f0f655ac1d039a4dc17853e5

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1532207: Do not query the CSP from the principal within LoadFrame, but rather do not even set the Principal if it does not override the CSP within nsContentUtils::GetAttrTriggeringPrincipal. r=bz,kmag

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0fa435d1823c2944656578243b2c02ae84fe3c3a

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

I did 'Preview Landing' in Lando and it showed me 'Landing Queued' but the patch never landed - until I figure out what the problem was I am requesting 'checkin-needed' for this one.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f101c9664b87
Do not query the CSP from the principal within LoadFrame, but rather do not even set the Principal if it does not override the CSP within nsContentUtils::GetAttrTriggeringPrincipal. r=bzbarsky

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/f101c9664b87