1953866 - Add a strict script-src CSP to browser.xhtml

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Tom Schuster (MoCo) [PTO Dec 23 - Jan 4]]

We currently use the policy script-src-attr 'none' for browser.xhtml's CSP, we should upgrade this to script-src chrome: resource:. The most important aspect is that this would disallow inline scripts in addition to inline event handlers.

Comment 1

[Tom Schuster (MoCo) [PTO Dec 23 - Jan 4]]

I think I am going to have to add 'unsafe-eval' to the allowed sources. We already block eval in the parent-process and system principals (bug 1582229). However we still have quite a lot of tests that depend on the pref security.allow_eval_with_system_principal to opt-out of the eval restriction. So instead of fixing all of these eval uses, I believe we can rely on that restriction instead.

Comment 2

[Tom Schuster (MoCo) [PTO Dec 23 - Jan 4]]

Attachment: Bug 1953866 - Add a strict script-src CSP to browser.xhtml for Nightly/Beta. r?freddyb!,#firefox-desktop-core-reviewers!

Comment 3

[Frederik Braun [:freddy]]

There are some unknown instances of eval that we never fully got rid of after https://bugzilla.mozilla.org/show_bug.cgi?id=1582229. We should definitely look at those, but maybe as a follow-up

Comment 4

[Tom Schuster (MoCo) [PTO Dec 23 - Jan 4]]

It seems like the remaining eval uses don't happen in the context of browser.xhtml, so they don't block this work. We should still try to get rid of them of course.

Comment 5

[Tom Schuster (MoCo) [PTO Dec 23 - Jan 4]]

Attachment: Bug 1953866 - Allow moz-src: by default in our CSPs for chrome:/resource: documents. r?freddyb

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ecbd70eba6bd
Allow moz-src: by default in our CSPs for chrome:/resource: documents. r=simonf

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ecbd70eba6bd

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59bf42331983
Add a strict script-src CSP to browser.xhtml for Nightly/Beta. r=freddyb,firefox-desktop-core-reviewers ,mossop

Comment 9

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/59bf42331983