1587939 - Support addon csp in the script security manager

Status: RESOLVED FIXED

(WebExtensions :: General, enhancement, P2)

Description

[Shane Caraveo (:mixedpuppy)]

Currently addon content scripts that use eval and new Function do not trigger csp violations.

This can be addressed in nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction by checking for a csp on the expanded principal.

Comment 1

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1587939 enforce addon content script CSP in eval

Comment 2

[Shane Caraveo (:mixedpuppy)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=6d70a54c762aac6e2ad85516bd2d9330b12b2be4

Comment 3

[Shane Caraveo (:mixedpuppy)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b0a77256fc843d2db40a815e062ba703ba51a893

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/23c113d65b48
enforce addon content script CSP in eval r=ckerschb,robwu

Comment 5

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/23c113d65b48

Comment 6

[Miruna Curtean]

Hello,

Will this fix require manual validation? If yes, please provide some steps to reproduce in order to correctly test it and also, please set the "qe-verify+" flag. Otherwise, could the "qe-verify-" flag be added? Thanks!

Comment 7

[Shane Caraveo (:mixedpuppy)]

There are tests