1942025 - The CSP of about:privatebrowsing is too permissive

Status: RESOLVED FIXED

(Firefox :: Private Browsing, defect)

Description

[Tom Schuster]

The about:privatebrowsing page uses the following CSP policy: default-src chrome: blob:; object-src 'none'. This means scripts/styles etc. can be loaded dynamically from a blob URL. I didn't immediately see where this page even uses blobs. All our default-src policy should only include chrome: and resource:.

Comment 1

[Tom Schuster]

It seems like we load the logo inside the search bar from a blob URL.

Comment 2

[Tom Schuster]

Attachment: Bug 1942025 - Improve the about:privatebrowsing CSP. r?#firefox-desktop-core-reviewers

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/32d761bfc411
Improve the about:privatebrowsing CSP. r=firefox-desktop-core-reviewers ,Gijs

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/32d761bfc411

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:tschuster, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox135 to wontfix.

For more information, please visit BugBot documentation.

Comment 6

[Tom Schuster]

I don't think we need to uplift this.