1805948 - astrobiology.nasa.gov not loading on FF 108

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Dianna Smith [:diannaS]]

Attachment: actual108Mac.png

Filing this bug from reddit reports:
https://www.reddit.com/r/firefox/comments/zml8jl/astrobiologynasagov_not_loading_on_ff_but_does_on/

"Tried this in 2 different Windows computers, one on Win 10 w/ FF 108.0 stable and another on Win 11 and FF 109 beta, with all extensions disabled. I only get the headers, but the content is blank and on the same PCs Edge and Chrome are fine. Anyone can tell what's going on? https://astrobiology.nasa.gov/"

I was able to recreate this on a MacOS 12.2.1
I ran mozregression and narrowed it down to bug 1797070

STR:
-Simply load https://astrobiology.nasa.gov/ and notice only the headers appear and no image

Comment 1

[Dianna Smith [:diannaS]]

Attachment: Expected108Mac.png

Expected results from previous builds

Comment 2

[Daniel Veditz [:dveditz]]

The problem is not exactly adding preffed-off support for 'unsafe-hashes' in bug 1797070, but that the patch included the fix for bug 1644790 (CVE-2022-46873): pages got 'unsafe-hashes' behavior even when they didn't ask for it.

Comment 3

[Daniel Veditz [:dveditz]]

If you set the pref security.csp.unsafe-hashes.enabled to true the site works.

Comment 4

[Tom Schuster]

Everything Daniel said is correct. We should probably just ship 'unsafe-hashes'. I am going to attach a patch to bug 1343950.

Comment 5

[Tom Schuster]

Interestingly enough even with 'unsafe-hashes' the page still seems to have some inline style defined via JS that is blocked. However I see something similar in Chrome as well.

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“style-src”). widgets.f26384f93da6.js:1:29228

Comment 6

[Dianna Smith [:diannaS]]

Fixed in bug 1343950 by enabling security.csp.unsafe-hashes.enabled and verified on 110.0a1 on MacOS 12.2.1

Comment 7

[Dianna Smith [:diannaS]]

Setting 108 to wontfix since there is a workaround

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Bug 1343950 has been uplifted to Beta for 109.0b8 also now.