1682153 - Script resources blocked by CSP are not displayed in the Network Monitor with Fission Enabled

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Hubert Boma Manilla (:bomsy)]

STR

1. Go to https://indigo-dandelion-particle.glitch.me/
2. Open the Network monitor
3. Make sure "Disable Cache" is checked
4. Make sure all fission prefs are on , especially devtools.testing.enableServerWatcherSupport
5. Reload the page

Actual results:
Cannot see the script request which is blocked by CSP in the Network Monitor.

Expected results:
Script request blocked by CSP should be displayed in the network monitor.

Note:
Setting the devtools.testing.enableServerWatcherSupport to false, reloading the browser and then the page causes the script to show up.

Also this causes browser_net_block-csp.js test to fail, this would be disabled for fission until this is fixed.

Comment 1

[Hubert Boma Manilla (:bomsy)]

Hello Valentin,
We see this issue with fission enabled, scripts are no longer visible.
It seems closely related to Bug 1638259, where a solution is suggested.
Do you think that's a fair assumption, I'm look to investigate and try that.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Hi Hubert,

Yes, I suspect it's the same issue.
Christoph could probably confirm if that's the case.

Comment 3

[Chris Peterson [:cpeterson]]

Tracking dt-fission-m3-mvp bugs for Fission MVP.

Comment 4

[Hubert Boma Manilla (:bomsy)]

Thanks Valentin!

Hello Christoph,
Would you be able to confirm that this issue is closely related to Bug 1638259.

Comment 5

[Hubert Boma Manilla (:bomsy)]

Moving to the networking component

Comment 6

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Hubert Boma Manilla (:bomsy) from comment #4)

Would you be able to confirm that this issue is closely related to Bug 1678795.

Yes, this bug is very similar to (in fact the same problem as) Bug 1678795. In particular, see Comment 22 in Bug 1678795.

Very likely we have that problem for more content types, not only style and script - basically whenever we perform a security check where we do not have a created an nsIChannel yet. In particular we can search for SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK which provides all the problematic callsites.

Comment 7

[Andrew Sutherland [:asuth] (he/him)]

I think there was a copy and paste error starting in comment 4 and that we're actually talking about bug 1638259 because :ckerschb's comment in comment 6 linking to a comment was linking to https://bugzilla.mozilla.org/show_bug.cgi?id=1638259#c22. :ckerschb can you confirm this?

Comment 8

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Andrew Sutherland [:asuth] (he/him) from comment #7)

I think there was a copy and paste error starting in comment 4 and that we're actually talking about bug 1638259 because :ckerschb's comment in comment 6 linking to a comment was linking to https://bugzilla.mozilla.org/show_bug.cgi?id=1638259#c22. :ckerschb can you confirm this?

Yes, thanks for fixing that up and sorry about the confusion, it's comment 22 in Bug 1638259 I was talking about.

Comment 9

[Hubert Boma Manilla (:bomsy)]

Thanks for the catch Andrew, I made the original mistake in comment 4.
Thanks

Comment 10

[Chris Peterson [:cpeterson]]

Moving some dt-fission-m3-mvp bugs from Fission MVP to M7 (blocking Beta experiment).

Comment 11

[Chris Peterson [:cpeterson]]

Tracking dt-fission-m3-mvp test and infrastructure bugs for Fission M8 (blocking Release experiment).

Comment 12

[Chris Peterson [:cpeterson]]

Tracking DevTools Post-M8 bugs for Fission MVP milestone. They don't block the Fission Release channel experiment, but we would like them to be completed before we roll out Fission by default.

Comment 13

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1682153 - [devtools] Enable CSP script blocking test r=nchevobbe

Depends on D103665

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3eb17e639591
[devtools] Enable CSP script blocking test r=nchevobbe

Comment 15

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/3eb17e639591