2052011 - about:config fails to load on Fenix due to inline JS being blocked by CSP

Status: RESOLVED FIXED

(Firefox for Android :: General, defect)

Description

[doug.hs]

Attachment: Screenshot_20260701-124058_Firefox Nightly.png

Steps to reproduce:

1. Install Firefox Nightly from Play Store.
2. Visit about:config

Actual results:

The page opens up blank, with an endless spinning/loading animation. Upon inspection, there are multiple Content-Security-Policy errors in the console.

Expected results:

Load about:config

Comment 1

[doug.hs]

I'm on Android 16 (LineageOS 23.2 + Google Apps).

Comment 2

[doug.hs]

These are the errors in the console:

Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-4n0K6PWd1MZ2/oOHGVsHjJssMPi35CwGFJu24T0PCVM=') together with 'unsafe-hashes'.
Source:        NewPrefDialog.init();       About… config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-Tw0eAtyEOPWtNlGYA4jXfmnwqNG91QDeLs3yhoNch68=') together with 'unsafe-hashes'.
Source: AboutConfig.uninit() config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-8S8fnD6J4ircnEtEFEde9tIwifCFUKu6KeyLhXhY9wY=') together with 'unsafe-hashes'.
Source: NewPrefDialog.toggleShowHide() config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-yEc2+OhLqfTshn9qok3JG6JFxeMWB/8UDR3lWj7PiZM=') together with 'unsafe-hashes'.
Source: AboutConfig.bufferFilterInput() config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-Jw+6m6QTtljDwsvYmtO2iouZU+EiAN0knCsv29NgLJ8=') together with 'unsafe-hashes'.
Source: AboutConfig.filterInput.blur(); config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-SCqVXRSgIIDktaIiV+pSFXj+/HMwj/Q+ER/m6NkiWCY=') together with 'unsafe-hashes'.
Source: NewPrefDialog.focusName(event) config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-XVWIAFw3MptcD2fboGx45tIMxSjGY7Hef4yIGgBKUOU=') together with 'unsafe-hashes'.
Source: NewPrefDialog.updateName(event) config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-ckmbUgkcoAo+ITUjG/BmYMvCrIIz2jlfVTC2O5nWSvY=') together with 'unsafe-hashes'.
Source: NewPrefDialog.type = event.target.value config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-GP2BcIasD39ittf2rj1ySb2e37BJQXtJ0HUlIupgcp4=') together with 'unsafe-hashes'.
Source: NewPrefDialog.toggleBoolValue() config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-vNGePmJd/v1zrcW3A05e76UF/+aB5gIDytHDGinQg8I=') together with 'unsafe-hashes'.
Source: NewPrefDialog.hide() config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-DCHMKdNzCb8B/iGKzy9NnSdH0moTnRA9a9afCuL8ws4=') together with 'unsafe-hashes'.
Source: NewPrefDialog.create(event) config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-ZuO/tT8KJOB/ZYK3N3XHzS67iLQSdLdyztht+4GhUug=') together with 'unsafe-hashes'.
Source: AboutConfig.clipboardCopy('name') config
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src chrome: resource: moz-src:”. Consider using a hash ('sha256-mM5XzCPkoMStR+Wla+mfqUWaic8AhzIRiBwf3Pov2Os=') together with 'unsafe-hashes'.
Source: AboutConfig.clipboardCopy('value') config

Comment 3

[doug.hs]

Firefox Nightly version: 154.0a1, buildID 20260701

Comment 4

[Non-IT Expert]

I am seeing this same issue! I'm using same Firefox Nightly build (154.0a1) on Samsung S22U with OS Android 16.

Comment 5

[Tom Schuster [:tschuster]]

I suspect this might have been caused by bug 2040297. But I am a bit confused as to how this never came up before.

Comment 7

[BugBot [:suhaib / :marco]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 8

[Tom Schuster [:tschuster]]

Attachment: Bug 2052011 - Remove inline JS from about:config in GeckoView. r?#geckoview-reviewers

Comment 9

[Tom Schuster [:tschuster]]

This should theoretically fix the issue, but if someone wants to steal this and test it out for real I would appreciate it!

Comment 10

[Tom Schuster [:tschuster]]

I tried it out in an emulator and it seems to work.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/609faad611b3
https://hg.mozilla.org/integration/autoland/rev/aad99d830a68
Remove inline JS from about:config in GeckoView. r=geckoview-reviewers,nalexander

Comment 12

[rperta]

https://hg.mozilla.org/mozilla-central/rev/aad99d830a68

Comment 13

[Ted Campbell [:tcampbell]]

This is broken in Fx153. We disable about:config there, but for historical accidents chrome://geckoview/content/config.xhtml is still available and powerusers are disappointed if it break.

Tom, can we consider uplifting to the next scheduled dot release? Risk seems relatively low since it is already broken and your patch is relatively tame.

Comment 14

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Due to another bug 2038660, the CSP already applies to loads via chrome:// in 153. And because the about:config isn't available in release this can't be bypassed.
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Patch already tested. This a hidden feature.
• String changes made/needed?: no
• Is Android affected?: yes

Comment 15

[Tom Schuster [:tschuster]]

Attachment: Bug 2052011 - Remove inline JS from about:config in GeckoView.

Original Revision: https://phabricator.services.mozilla.com/D310051

Comment 16

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/0c68a35be677
https://hg.mozilla.org/releases/mozilla-release/rev/06270e606848