1939490 - Remove inline style from MozPanel

Status: RESOLVED FIXED

(Toolkit :: UI Widgets, defect)

Description

[Tom Schuster (MoCo)]

Every time I open the devtools, I see a bunch of CSP violations in the parent process.

Content-Security-Policy: The page’s settings blocked an inline style (style-src-attr) from being applied because it violates the following directive: “default-src chrome: resource:” 2 customElements.js:499:25
Content-Security-Policy: The page’s settings blocked an inline style (style-src-attr) from being applied because it violates the following directive: “default-src chrome: resource:”

This is apparently caused by the inline style in the MozPanel markup.

I plan on adding telemetry for CSP violations in the parent process, so this would be nice to avoid. Otherwise I am just going to filter these out.

Comment 1

[Alexandre Poirot [:ochameau]]

If it comes from <xul:panel> then it isn't specific to DevTools:
https://searchfox.org/mozilla-central/search?q=createXULElement%28%22panel%22%29&path=&case=false&regexp=false

Comment 2

[Alexandre Poirot [:ochameau]]

These other usages of panel doesn't seem to trigger CSP warning, whereas they are also done on chrome: document.
Any idea why they wouldn't be triggered against browser.xhtml?

Comment 3

[Tom Schuster (MoCo)]

Other panel users probably have a less restrictive CSP or no CSP at all. Devtools seems to use default-src chrome: resource:; and no style-src.

Obviously it would best to remove the inline style instead of making the devtools' CSP weaker.

Comment 4

[Nicolas Chevobbe [:nchevobbe]]

indeed, the following seems to make the error go away:

diff --git a/devtools/client/framework/toolbox.xhtml b/devtools/client/framework/toolbox.xhtml
--- a/devtools/client/framework/toolbox.xhtml
+++ b/devtools/client/framework/toolbox.xhtml
@@ -7,7 +7,7 @@
 <window
   xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   xmlns:html="http://www.w3.org/1999/xhtml"
-  csp="default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'"
+  csp="default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'; style-src 'unsafe-inline';"
   role="application"
 >
   <linkset>

Comment 5

[Frederik Braun [:freddy]]

Looks like you're using a custom element that has a style= attribute. The more minimal CSP would allow style-src-attr rather than all of style-src.

I think the code is from https://searchfox.org/mozilla-central/rev/ead020d3989d3e9477b353d3d117f9c0f4b16f53/toolkit/content/widgets/panel.js#12, so maybe we should move this to Toolkit :: UI Widgets so that it's fixed at the source and for all consumers?

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The product::component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit BugBot documentation.

Comment 7

[Tom Schuster (MoCo)]

I will try to fix this so we don't end up with so many unnecessary telemetry pings.

Comment 8

[Tom Schuster (MoCo)]

Attachment: Bug 1939490 - Stop using inline style for MozPanel. r?Gijs

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bb65a5456898
Stop using inline style for MozPanel. r=Gijs,emilio

Comment 10

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/bb65a5456898