Closed Bug 1685627 Opened 4 years ago Closed 2 years ago

Look into setting our base csp on workers created from addons

Categories

(WebExtensions :: General, enhancement, P2)

Product:
WebExtensions
Component:
General
Type:
enhancement
Points:
5

Tracking

(firefox104 fixed)

Status:
RESOLVED FIXED
Milestone:
104 Branch
Tracking Flags:
Tracking Status
firefox104 --- fixed

People

(Reporter: mixedpuppy, Assigned: rpl)

References

(Blocks 1 open bug, Regressed 1 open bug)

Details

(Keywords: sec-want, Whiteboard: mv3:m2 [mv3-m2] [adv-main104-])

Attachments

(1 file)

Bug 1685627 - Use extension CSP for workers with a moz-extension url.
48 bytes, text/x-phabricator-request
Details | Review

CSP is not inherited (bug 1413492) so we will need to look at what should be done to set proper csp limitations on them.

Do you have a test case?

I forgot to, but I meant to file a bug about new Worker(url) being able to load a worker with the origin of the given URL, despite the caller origin being a moz-extension:-URL. That is, an extension with the right host permission is able to load a cross-origin worker. This may not entirely be desired...

CSP directive worker-src is enforced for the URL for the Worker constructor (despite cross-origin Workers not being desired behavior).

See Also: → 1413492
Whiteboard: mv3:m2
Whiteboard: mv3:m2 → mv3:m2 [mv3-m2]
Points: --- → 5
Whiteboard: mv3:m2 [mv3-m2] → mv3:m2 [mv3-m2]
Keywords: sec-want
See Also: → 1770468
Assignee: nobody → lgreco
Status: NEW → ASSIGNED
Pushed by luca.greco@alcacoop.it:
https://hg.mozilla.org/integration/autoland/rev/53c490e52eb6
Use extension CSP for workers with a moz-extension url. r=asuth,mixedpuppy

https://hg.mozilla.org/mozilla-central/rev/53c490e52eb6

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox104: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 104 Branch
Regressions: 1776962
Whiteboard: mv3:m2 [mv3-m2] → mv3:m2 [mv3-m2] [adv-main104-]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: