931107 - ShouldLoad inconsistency of aRequestingLocation between images and fonts requested from css files

Status: NEW

(Core :: Security, defect)

Description

[Christoph Kerschbaumer [:ckerschb}]

When working on Bug 909920 we realized that |aRequestingLocation| in ShouldLoad is different when loading images and fonts from a CSS file.

For images:
   http://people.mozilla.org/~tvyas/darkreading.html
aRequestingLocation is the CSS file.

For fonts:
   http://people.mozilla.org/~tvyas/darkreading-font2.html
aRequestingLocation in the HTML file.

We think aRequestingLocation should be the CSS file in both cases.

Comment 1

[Tanvi Vyas[:tanvi]]

Also, when you import css from css, I believe aRequestingLocation is the CSS file.
http://people.mozilla.org/~tvyas/darkreading-style.html

Christoph can confirm.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I believe for fonts the HTML file was purposefully chosen because of the security-check behavior we wanted here.  John should have the details...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Hrm, or maybe this part was Jonathan, actually, looking at the blame.

Comment 4

[Boris Zbarsky [:bzbarsky]]

No, definitely John.

See bug 457825 for the discussion.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Maybe the right answer is that we should use a different principal for the CheckMayLoad check and the content policy check.  That has an immediate smell to me, though...

Comment 6

[John Daggett (:jtd)]

From the CSS Fonts spec:

https://drafts.csswg.org/css-fonts/#font-fetching-requirements

 "When fetching, user agents must use "Anonymous" mode, set the
  referrer source to the stylesheet's URL and set the origin to
  the URL of the containing document."