1537685 - Add test that iterates all about: pages and ensure they all have a valid CSP

Status: NEW

(Core :: DOM: Security, enhancement, P2)

Description

[Christoph Kerschbaumer [:ckerschb]]

It seems it's possible that about pages can still ship without a CSP attached as illustrated within [1]. Maybe it's possible to add a test where we can iterate all about pages and ensure they all have a valid CSP.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1449845#c15

Comment 1

[Sebastian Streich [:sstreich]]

Attachment: Bug 1537685 - Add Test To Check Internal Pages for a CSP r=ckerschb

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:sstreich, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Landing this bug is blocked on Bug 1492063 - once that has been resolved we can land the patch within this bug.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Basti, all about: pages are secured by a CSP (see https://bugzilla.mozilla.org/show_bug.cgi?id=1492063#c4) I think we can move forward with this bug now, though I remember you wanted to slightly rewrite it so it doesn't depend on xul right?

Comment 5

[Sebastian Streich [:sstreich]]

Rewrite is not needed atm, (i was assuming the XUL removal was meaning that .xul test would be rendered unusable, but that was false).
I've run the test quickly through try.
https://treeherder.mozilla.org/#/jobs?repo=try&selectedJob=270460474&revision=7eb48292e2fc5485b1d1ca9a760fc48046d60eb9
But it reports missing csp for:
TEST-UNEXPECTED-FAIL | about:credits - Has at Least 1 CSP Rule. Count: 0
TEST-UNEXPECTED-FAIL | about:logo - Has at Least 1 CSP Rule. Count: 0
TEST-UNEXPECTED-FAIL | about:sync-log - Has at Least 1 CSP Rule. Count: 0

I've already seen in the meta bug that i should probably whitelist - about:sync-log as in 1497212.
Can i assume the the other 2 are working the same way?

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Sebastian Streich [:sstreich] from comment #5)

But it reports missing csp for:
TEST-UNEXPECTED-FAIL | about:credits - Has at Least 1 CSP Rule. Count: 0

Hm, that one is interesting. Not sure why that would be failing. Running about:credits in the browser itself works, but it loads the actual page from the web, so we need to figure out what we load in the test where we definitely not load things from the web. Probably we have some dummy page that we load, we should add a CSP there.

TEST-UNEXPECTED-FAIL | about:logo - Has at Least 1 CSP Rule. Count: 0

I filed Bug 1587417 to add about:logo to the allowlist because adding a CSP to it doesn't make sense.

TEST-UNEXPECTED-FAIL | about:sync-log - Has at Least 1 CSP Rule. Count: 0

That is in the allowlist, so you should probably greenlight in the test, see: https://searchfox.org/mozilla-central/source/dom/security/nsContentSecurityUtils.cpp#478

Comment 7

[Sebastian Streich [:sstreich]]

Hm, that one is interesting. Not sure why that would be failing. Running about:credits in the browser itself works, but it loads the actual page from the web, so we need to figure out what we load in the test where we definitely not load things from the web. Probably we have some dummy page that we load, we should add a CSP there.

Just checked that, we're getting a 404 page from the test server, so i will just skip the page in the test. thanks for clarifying!