1638826 - A page's CSP base-uri affects pdf.js

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Christoph Kerschbaumer [:ckerschb]]

Within Bug 1582115 we fixed the problem that a page's CSP script-src directive affects pdf.js. It seems a page's base-uri might also affect a pdf.js but uses a different code path within Firefox. While Bug 1582115 was uplifted to Beta, the change here requires some refactoring which is probably to worry-some to uplift that close to the end of the cycle. I rather fix the base-uri problem within this bug as a follow up to Bug 1582115

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1638826: Exempt pdfjs from being subject to CSP permits function. r=baku

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2b4796470c0b
Make CSP permits function (e.g. restricting base-uri) consult subjectCSP before enforcing CSP. r=baku

Comment 3

[Narcis Beleuzu [:NarcisB]]

Backed out for wpt failure on form-action-src-javascript-blocked.sub.html

Backout link: https://hg.mozilla.org/integration/autoland/rev/90b6e0e32402202184bd54e196262d4d99c6f1e8
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=303601769&repo=autoland&lineNumber=1574

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

huh, rock solid we have that test - I'll take a look!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/85e58f1534d4
Exempt pdfjs from being subject to CSP permits function. r=baku

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/85e58f1534d4