1789751 - Remove localhost from the extension's base script-src CSP directive, at least from MV3

Status: RESOLVED FIXED

(WebExtensions :: General, task)

Description

[Rob Wu [:robwu]]

The base extension CSP contains "localhost". That does not make sense, as the goal of MV3 is to reject remote code execution in a privileged context.

It looks like we added localhost in bug 1594234:

• new: https://hg.mozilla.org/mozilla-central/rev/76491eab6179a27905998c7e48ef467c5299ae5d#l4.13
• old: https://hg.mozilla.org/mozilla-central/rev/76491eab6179a27905998c7e48ef467c5299ae5d#l3.13

Note that while the bug's intent is to make the CSP stricter, the patch actually allows http://localhost to be referenced even when it was not supported before.

I believe that this was a mistake, derived from Chrome's documentation at https://developer.chrome.com/docs/extensions/mv3/intro/mv3-migration/, which currently states

In addition, Manifest V3 disallows certain CSP modifications for extension_pages that were permitted in Manifest V2. The script-src, object-src, and worker-src directives may only have the following values:

• self
• none
• Any localhost source, (http://localhost, http://127.0.0.1, or any port on those domains)

That in its turn is likely a mistake from a Chrome engineer who implemented the CSP in MV3: Search for IsLocalHostSource in https://chromium.googlesource.com/chromium/src.git/+/11c67e5998f4dbb2d04b3e149c83e3f585846f2a%5E%21/. There are three occurrences:

• The IsLocalHostSource helper that allows http://localhost and http://127.0.0.1
• The original MV2 CSP validation logic, that used to allow a whole bunch of sources.
• The new MV3 CSP validation logic that allows 'self', 'none' and localhost.

What I suspect to have happened is that whoever who implemented it looked at the MV2 implementation, and removed items that are considered remote/insecure, but mistakenly classified localhost as local/secure.

Despite that validation implementation, localhost can still not be loaded as a script in practice, because their base CSP (they call it "minimum CSP") does not contain localhost, only 'self' and 'unsafe-wasm-eval':

• https://source.chromium.org/chromium/chromium/src/+/main:extensions/common/manifest_handlers/csp_info.cc;l=45;drc=6e68a946f87e487c904a906639f621796b06c9ea

So in conclusion, I recommend to remove localhost from our base CSP.
With that, we can also reject http(s) script loads in extensions, even at the process level (e.g. like what CheckAllowLoadInSystemPrivilegedContext does for the system principal).

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 1789751 - Remove localhost from MV3 CSP

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9bee44dbde20
Remove localhost from MV3 CSP r=mixedpuppy

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/9bee44dbde20

Comment 4

[Rob Wu [:robwu]]

(In reply to Rob Wu [:robwu] from comment #0)

So in conclusion, I recommend to remove localhost from our base CSP.
With that, we can also reject http(s) script loads in extensions, even at the process level (e.g. like what CheckAllowLoadInSystemPrivilegedContext does for the system principal).

I found bug 1767798 where this is tracked.