Closed Bug 1597645 (CVE-2019-17020) Opened 5 years ago Closed 5 years ago

Content-Security-Policy inline script execution is bypassed on XSL pages

Categories

(Core :: DOM: Security, defect, P2)

Product:
Core
Component:
DOM: Security
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla72
Tracking Flags:
Tracking Status
firefox-esr68 --- unaffected
firefox71 --- wontfix
firefox72 --- fixed

People

(Reporter: matthew-bugzilla, Assigned: sstreich)

References

(Regression,
URL
)

Details

(Keywords: regression, reporter-external, sec-moderate, Whiteboard: [reporter-external] [client-bounty-form] [verif?][domsecurity-active][adv-main72+][post-critsmash-triage])

Attachments

(2 files)

Bug 1597645 - Make sure XSLT inherits the CSP r=ckerschb
47 bytes, text/x-phabricator-request
Details | Review
advisory.txt
433 bytes, text/plain
Details

I discovered this issue while implementing an XSL stylesheet on an RSS feed.
Firefox (I am running version 70.0.1 on Windows 10) does not honour the Content-Security-Policy header on inline JavaScript given in an XSL template included by an XML file.

I have made some test cases which I hope are helpful:

  • https://traintimes.org.uk/firefox-csp/ shows the main issue I found - it is an XML file sent with a CSP header saying no inline JavaScript, but includes an XSL stylesheet containing a template with inline JavaScript that does run in Firefox (both the inline script and the inline event handler);
  • https://traintimes.org.uk/firefox-csp/html.php is the same HTML, as the XSL template but served as HTML, and here you can see the inline JavaScript does not run in Firefox.

In Chrome, you get the error: "Refused to execute inline script because it violates the following Content Security Policy directive" on both HTML and XML versions.

Flags: sec-bounty?
Group: firefox-core-security → dom-core-security
Component: Security → DOM: Security
Product: Firefox → Core

Basti, can you take a look please?

Flags: needinfo?(sstreich)
Assignee: nobody → sstreich
Flags: needinfo?(sstreich)
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Priority: -- → P2
Whiteboard: [reporter-external] [client-bounty-form] [verif?] → [reporter-external] [client-bounty-form] [verif?][dom-security-active]
Whiteboard: [reporter-external] [client-bounty-form] [verif?][dom-security-active] → [reporter-external] [client-bounty-form] [verif?][domsecurity-active]

https://hg.mozilla.org/mozilla-central/rev/514599002875

Group: dom-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
status-firefox72: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla72

Is this something we should consider backporting to ESR68 as well or is riding with Fx72 sufficient?

status-firefox71: --- → wontfix
status-firefox-esr68: --- → affected
tracking-firefox-esr68: --- → ?
Flags: needinfo?(sstreich)
Flags: in-testsuite+

I just checked this on ESR68 - can confirm it is not affected.
My guess is, this got introduced with Bug 965637 which landed on 69

status-firefox-esr68: affected → unaffected
Flags: needinfo?(sstreich)
Flags: sec-bounty? → sec-bounty+
Keywords: regression
Regressed by: 965637
Type: task → defect
Whiteboard: [reporter-external] [client-bounty-form] [verif?][domsecurity-active] → [reporter-external] [client-bounty-form] [verif?][domsecurity-active][adv-main72+]
Attached file advisory.txt —
Flags: qe-verify-
Whiteboard: [reporter-external] [client-bounty-form] [verif?][domsecurity-active][adv-main72+] → [reporter-external] [client-bounty-form] [verif?][domsecurity-active][adv-main72+][post-critsmash-triage]
Alias: CVE-2019-17020
Group: core-security-release
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: