Closed Bug 2091892 Opened 3 days ago Closed 12 hours ago

[wpt-sync] Sync PR 64540 - Only pass verified integrity metadata on ModuleMap CSP re-check

Tracking

()

Status:

RESOLVED FIXED

Milestone:

162 Branch

Tracking Flags:

Tracking

Status

firefox162

---

fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Description

•

3 days ago

Sync web-platform-tests PR 64540 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/64540
Details from upstream follow.

Camille Lamy <clamy@chromium.org> wrote:

Only pass verified integrity metadata on ModuleMap CSP re-check

When a module script hits an existing entry in the ModuleMap,
FetchSingleModuleScript re-checks CSP with the request's parser state to
prevent a modulepreload strict-dynamic bypass. Previously, that re-check
passed the consumer request's integrity metadata even when it did not
match the entry's SRI-verified integrity metadata, allowing an
unverified integrity attribute matching a policy hash to satisfy CSP
without SRI enforcement.

Only forward the request's integrity metadata to AllowScriptFromSource()
when it matches the cached entry's integrity metadata; otherwise pass an
empty set.

Bug: 574603289
Change-Id: I1fe6aa02c3d0e6e476d60c849d128df6f66bee00
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8674247
Reviewed-by: Mike West \<mkwst@chromium.org>
Commit-Queue: Camille Lamy \<clamy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1732722}

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Updated

•

3 days ago

Component: web-platform-tests → DOM: Security

Product: Testing → Core

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Comment 1

•

3 days ago

Pushed to try (stability) https://treeherder.mozilla.org/jobs?repo=try&landoInstance=lando-prod-2025&landoCommitID=118769

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Comment 2

•

2 days ago

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 98 tests and 2 subtests

Status Summary

Firefox

OK : 1[GitHub] 96[Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] 97[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
PASS : 3[GitHub] 214[Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] 217[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
FAIL : 3[GitHub] 37[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]

Chrome

OK : 1
PASS : 3
FAIL : 3

Safari

PASS : 2
FAIL : 1
TIMEOUT: 4

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

/content-security-policy/script-src/scriptnonce-basic-blocked.sub.html [wpt.fyi]: SKIP
/content-security-policy/script-src/script-src-1_4_1.html [wpt.fyi]: OK [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt], SKIP [Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_integrity_mismatch.html [wpt.fyi]
- Parser-inserted external module script with unverified integrity hitting a modulepreload entry is blocked with strict-dynamic.: FAIL (Chrome: FAIL, Safari: TIMEOUT)
- Parser-inserted external module script with policy hash hitting a modulepreload entry with dummy integrity is blocked with strict-dynamic.: FAIL (Chrome: FAIL, Safari: TIMEOUT)
- Parser-inserted data: module script with unverified integrity hitting a modulepreload entry is blocked with strict-dynamic.: FAIL (Chrome: FAIL, Safari: TIMEOUT)
/content-security-policy/script-src/tentative/script-url-allowed-by-hash.https.html [wpt.fyi]
- script-src should allow script by its url hash - header: FAIL
- A parseable url-hash should ignore hostname allowlists - header: FAIL
- default-src should allow script by its url hash - header: FAIL
- script-src-elem should allow script by its url hash - header: FAIL
- url hashes should allow dynamically inserted script if allowlisted - header: FAIL
- url hashes should allow redirected scripts - header: FAIL
- dynamically inserted parser-inserted script should be allowed if strict-dynamic-url is present - header: FAIL
- dynamically inserted script inserted by an inline script should be allowed if strict-dynamic-url is present - header: FAIL
- script-src should allow script by its relative url's hash - header: FAIL
- script-src should allow script by its relative url's hash in child directory - header: FAIL
- script-src should allow script by its relative url's hash in an iframe in child dir - header: FAIL
- script-src should allow script in parent dir by its relative url's hash in an iframe in child dir - header: FAIL
- script-src should allow script by its url hash - metatag: FAIL
- A parseable url-hash should ignore hostname allowlists - metatag: FAIL
- default-src should allow script by its url hash - metatag: FAIL
- script-src-elem should allow script by its url hash - metatag: FAIL
- url hashes should allow dynamically inserted script if allowlisted - metatag: FAIL
- url hashes should allow redirected scripts - metatag: FAIL
- dynamically inserted parser-inserted script should be allowed if strict-dynamic-url is present - metatag: FAIL
- dynamically inserted script inserted by an inline script should be allowed if strict-dynamic-url is present - metatag: FAIL
- script-src should allow script by its relative url's hash - metatag: FAIL
- script-src should allow script by its relative url's hash in child directory - metatag: FAIL
- script-src should allow script by its relative url's hash in an iframe in child dir - metatag: FAIL
- script-src should allow script in parent dir by its relative url's hash in an iframe in child dir - metatag: FAIL
/content-security-policy/script-src/tentative/script-url-blocked-report-contains-hash-dedicated-worker.https.html [wpt.fyi]
- script-specific violation report contains correct urlHash in dedicated worker: FAIL
/content-security-policy/script-src/tentative/script-url-blocked-report-contains-hash-service-worker.https.html [wpt.fyi]
- script-specific violation report contains correct urlHash in service worker: FAIL
/content-security-policy/script-src/tentative/script-url-blocked-report-contains-hash-shared-worker.https.html [wpt.fyi]
- script-specific violation report contains correct urlHash in shared worker: FAIL
/content-security-policy/script-src/tentative/script-url-blocked-report-contains-hash.https.html [wpt.fyi]
- script-specific violation report contains correct urlHash: FAIL
/content-security-policy/script-src/tentative/url-hash-in-header-and-meta.https.html [wpt.fyi]
- more lax meta tag should still allow script: FAIL
- multiple meta tags should apply most strict policy - both lax: FAIL
/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module.html [wpt.fyi]
- Parser-inserted external module script that is also modulepreloaded is allowed with strict-dynamic.: FAIL
/content-security-policy/script-src/script-src-trusted_types_eval_multiple_policies_blocked.window.html [wpt.fyi]
- Direct eval is blocked by a second policy without trusted-types-eval.: FAIL
- new Function is blocked by a second policy without trusted-types-eval.: FAIL
/content-security-policy/script-src/script-src-trusted_types_eval_multiple_policies_report_only.window.html [wpt.fyi]
- eval is allowed but reported by a report-only policy without trusted-types-eval.: FAIL

Tests Disabled in Gecko Infrastructure

/content-security-policy/script-src/scriptnonce-basic-blocked.sub.html [wpt.fyi]: SKIP
/content-security-policy/script-src/script-src-1_4_1.html [wpt.fyi]: OK [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt], SKIP [Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Updated

•

2 days ago

Depends on: 2092667

Pulsebot

Comment 3

•

17 hours ago

Pushed by wptsync@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/4893dedfa6b2 https://hg.mozilla.org/integration/autoland/rev/001929c937e3 [wpt PR 64540] - Only pass verified integrity metadata on ModuleMap CSP re-check, a=testonly https://github.com/mozilla-firefox/firefox/commit/3d99c0636f2e https://hg.mozilla.org/integration/autoland/rev/81f8cc9a2b10 [wpt PR 64540] - Update wpt metadata, a=testonly

Sandor Molnar[:smolnar]

Comment 4

•

12 hours ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/001929c937e3
https://hg.mozilla.org/mozilla-central/rev/81f8cc9a2b10

Status: NEW → RESOLVED

Closed: 12 hours ago

status-firefox162: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 162 Branch

You need to log in before you can comment on or make changes to this bug.

Bugzilla

[wpt-sync] Sync PR 64540 - Only pass verified integrity metadata on ModuleMap CSP re-check

Categories

(Core :: DOM: Security, task, P4)

Tracking

()

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Crash Data

Security

(public)

User Story

Description

Updated

Comment 1

Comment 2

CI Results

Status Summary

Firefox

Chrome

Safari

Links

Details

New Tests That Don't Pass

Tests Disabled in Gecko Infrastructure

Updated

Comment 3

Comment 4