1600174 - No longer open Mail Compose Window of ProtonMail

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Alice0775 White]

Reproducible: always

Steps To Reproduce:

1. Log in https://mail.protonmail.com/login
2. Click [COMPOSE] button at the top-left

Actual Results:
Mail Compose Window would not open

Error in Web Condole:
Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively. 2
Content Security Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive.

Expected Results:
Mail Compose Window should open

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3bd3398c2f0c4a7853dec584457f4b71773718db&tochange=432a6d44236d2f6f5efd083fd14e0a1a0a34aa9e

Comment 1

[Christoph Kerschbaumer [:ckerschb}]

I'll take a look.

Comment 2

[Christoph Kerschbaumer [:ckerschb}]

Attachment: Bug 1600174: Only enfore CSP frame-ancestors check if the load comes from an actual http channel in content. r=smaug

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

FWIW, I filed Bug 1600310 so we get test coverage for that scenario.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/03e1c2a170f0
Only enfore CSP frame-ancestors check if the load comes from an actual http channel in content. r=smaug

Comment 5

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/03e1c2a170f0