1947457 - CSP-report document-uri is wrong

Status: NEW

(Core :: DOM: Security, defect, P4)

Description

[juha.hamalainen]

Steps to reproduce:

Go to a site where CSP or CSPRO is in use and report-uri defined.

Actual results:

When CSP violation is triggered, csp-report's document-uri is correct on first time, but if you navigate to another sub-page on that page and CSP violation happens again, csp-report's document-uri value points still to the first page.

Expected results:

Document-uri should have matched the uri where the violation happened. Shouldn't it be equal to document.documentURI which is shown also in browser's URL-bar? That's how it works on Chrome.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Frederik Braun [:freddy]]

Tom, can you take a look?

Comment 3

[Tom Schuster]

We use our old problematic mSelfURI to initialize the document-uri, which is just bound to cause issues like this. I think we could try do something to paper over this specific case however, by trying to retrieve the URL from mLoadingContext.

It still would be good to have a real test case for this. I didn't really expect the mSelfURI to be wrong for "simple" navigations.

Comment 4

[Frederik Braun [:freddy]]

but if you navigate to another sub-page on that page and CSP violation happens again, csp-report's document-uri value points still to the first page.

Given the description, I suppose this may have something to do with e.g., pushState