935690 - Document::InitCSP should not ignore return value of SetCsp

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Deian Stefan]

Following up on bug 919587 comment 10 and
bug 886164 comment 39:

We need to make sure that InitCSP checks handles failure of SetCSP in:

https://mxr.mozilla.org/mozilla-central/source/content/base/src/nsDocument.cpp#2723

Unfortunatelly, just failing when SetCsp fails reintroduces bug 919587.

Comment 1

[Deian Stefan]

Attachment: 0001-Bug-935690-InitCSP-checks-SetCsp-failure.patch

Comment 2

[Deian Stefan]

Try is good: https://tbpl.mozilla.org/?tree=Try&rev=729bee837023

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8335832 [details] [diff] [review]
0001-Bug-935690-InitCSP-checks-SetCsp-failure.patch

So this is OK now because data documents no longer InitCSP, right?

r=me

Comment 4

[Deian Stefan]

(In reply to Boris Zbarsky [:bz] from comment #3)
> Comment on attachment 8335832 [details] [diff] [review]
> 0001-Bug-935690-InitCSP-checks-SetCsp-failure.patch

Thanks to looking at all my trivial patches!
 
> So this is OK now because data documents no longer InitCSP, right?


Yes, that's right. I just tried the email client on b2g with this patch, the patch for bug 941404, and bug 88616; the issue reported in bug 919587 did not reappear.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/91c18951d81a

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/91c18951d81a