1963467 - [debug only] Crash when adding news account ("AccountWizard.xhtml does not have a CSP!")

Status: RESOLVED FIXED

(Thunderbird :: Account Manager, defect)

Description

[Francesco]

1. Run a debug build.
2. Try to add a news account in the Account settings.

[14608] Hit MOZ_CRASH(Document (chrome://messenger/content/AccountWizard.xhtml) does not have a CSP!) at /builds/worker/checkouts/gecko/dom/security/nsContentSecurityUtils.cpp:1991

The message seems to be wrong as the page has CSP. However, it also has inline styles.

CSP:
https://searchfox.org/comm-central/rev/45f8c5bb09a833038a6d3ff06a3ee552663b45e5/mailnews/base/prefs/content/AccountWizard.xhtml#42-45

Inline styles:
https://searchfox.org/comm-central/rev/45f8c5bb09a833038a6d3ff06a3ee552663b45e5/mailnews/base/prefs/content/AccountWizard.xhtml#115,136

Comment 1

[Magnus Melin [:mkmelin]]

That's a xul <window> doc still, so I guess we'll have to add the XUL version of CSP, like https://searchfox.org/mozilla-central/rev/e703d3fbd6da82cdda1256016a80abb1f245fedd/toolkit/components/prompts/content/commonDialog.xhtml#6, or convert the file to top level html.

Comment 2

[Magnus Melin [:mkmelin]]

Attachment: Bug 1963467 - Add XUL version of CSP to mailnews/base/prefs/content/AccountWizard.xhtml. r=BenC

Comment 3

[Francesco]

Will that work given the
https://searchfox.org/comm-central/rev/7cf8218b74a7799d6f8e8b322ddccb52afda1b06/mailnews/base/prefs/content/AccountWizard.xhtml#19
and
https://searchfox.org/comm-central/rev/45f8c5bb09a833038a6d3ff06a3ee552663b45e5/mailnews/base/prefs/content/AccountWizard.xhtml#115,136

There are three more that might need inspection:
https://searchfox.org/comm-central/rev/7cf8218b74a7799d6f8e8b322ddccb52afda1b06/mail/base/content/glodaFacetView.xhtml#38
https://searchfox.org/comm-central/rev/7cf8218b74a7799d6f8e8b322ddccb52afda1b06/mail/components/enterprisepolicies/content/aboutPolicies.xhtml#28
https://searchfox.org/comm-central/rev/7cf8218b74a7799d6f8e8b322ddccb52afda1b06/mailnews/base/prefs/content/converterDialog.xhtml#25

Comment 4

[Magnus Melin [:mkmelin]]

(In reply to Francesco from comment #3)

Will that work given the

It should, as that's what the CSP says should be allowed.
I didn't not actually run this in a debug build, but I verified the onload script ran (it wouldn't on release builds, if it was blocked by csp)

Good find on those others, I can add them here.

Comment 5

[Francesco]

(In reply to Magnus Melin [:mkmelin] from comment #4)

It should, as that's what the CSP says should be allowed.

The syntax isn't clear to me and it doesn't appear to be documented anywhere. I patched omni.ja in my debug build and your change works. Thanks.

Comment 6

[Magnus Melin [:mkmelin]]

• glodaVacetView.xhtml has a correct csp
• converterDialog.xhtml also has a crorrect csp already

Comment 7

[Magnus Melin [:mkmelin]]

(In reply to Francesco from comment #5)
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP has some documentation. Since there are mozilla-internal protocols involved it's somewhat more complex, but the documentation still applies

Comment 8

[Magnus Melin [:mkmelin]]

Attachment: Bug 1963467 - add CSP to about:policies. r=#thunderbird-reviewers

about:policies it seems is currently not easily accessible from within Thunderbird. But you can set it as startpage...

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/3f3a08b4a492
Add XUL version of CSP to mailnews/base/prefs/content/AccountWizard.xhtml. r=arschmitz

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/29ca4ca99314
add CSP to about:policies. r=john.bieling