1576206 - CSP errors on about:sessionrestore

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[:Gijs (he/him)]

There are 2 instances of CSP errors when loading an about:sessionrestore instance that has session data. I'm not sure what's triggering them, the devtools console only tells you it's from about:sessionrestore, which is no use. Unfortunately bug 1575620 makes it tricky to repeatedly reproduce, but Christoph, any chance you can investigate when you're back?

Comment 1

[Sebastian Streich [:sstreich]]

With the CSP in about:sessionrestore [1] we disallow any inline Script/Style yet we're trying to add some inline z-index in the <xul:treeview>
As the inline style was added in the same patch as the csp, (and also got blocked since then) i guess we can just remove it?

[1] https://searchfox.org/mozilla-central/source/browser/components/sessionstore/content/aboutSessionRestore.xhtml#14
[2] https://searchfox.org/mozilla-central/source/toolkit/content/widgets/tree.js#603

Comment 2

[Sebastian Streich [:sstreich]]

Attachment: Bug 1576206 - Remove inline Style that causes CSP Violations r=Gijs

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1fd9a3f8f130
Remove inline Style that causes CSP Violations r=Gijs

Comment 4

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/1fd9a3f8f130