1555043 - Sort out interaction of CSP and javascript: URLs

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

[Tracking Requested - why for this release]: Web-observable behavior change that we apparently didn't mean to make.

See https://github.com/whatwg/html/issues/4651

In particular, we changed our behavior here in bug 965637, which I am told was not purposeful. We need to decide whether we actually want that behavior change before we ship it accidentally.

Comment 1

[Kate Hudson :k88hudson]

Is this being worked on for 69?

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Kate Hudson :k88hudson from comment #1)

Is this being worked on for 69?

I am trying, yes.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1555043: Perform CSP check against target document's CSP for javascript: URIs. r=bz

Comment 4

[Boris Zbarsky [:bzbarsky]]

The web-visible change from bug 965637 was reverted in bug 1478037. So there's no need to track this anymore.

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Boris Zbarsky [:bzbarsky, bz on IRC] from comment #4)

The web-visible change from bug 965637 was reverted in bug 1478037. So there's no need to track this anymore.

In turn, this makes this bug a task. Thanks for your help here Boris.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/880fa3109604
Perform CSP check against target document's CSP for javascript: URIs. r=bzbarsky

Comment 7

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/880fa3109604