763930 - SecReview: Expose TCP Socket - Investigate restriction options - maybe via CSP. (nsiContentPolicy check)

Status: NEW

(mozilla.org :: Security Assurance, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview Action Item bug
Investigate restriction options - maybe via CSP. (nsiContentPolicy check)

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I am not sure what we want to do here. This definitely isn't base camp blocking, but it seems like for consistency, eventually we would want navigator.mozTCPSocket to respect the connect-src directive.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Paul Theriault [:pauljt] from comment #1)
> we would want navigator.mozTCPSocket to respect the connect-src
> directive.

+1

Also, mixed content blocker should block non-SSL TCP sockets in SSL contexts.

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Taking me off this since I am not working on this atm (it would be great it someone was...)

Comment 4

[Sid Stamm [:geekboy or :sstamm]]

Why is this blocking bug 663566?

Comment 5

[Daniel Veditz [:dveditz]]

Dunno, better question for bsmith. Given the summary I can see the desire to show some sort of tie to CSP, but it's clearly not part of the work required to implement the CSP 1.0 standard.