зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1452037 - Fix Whitelisting of javascript-uris with csp hash r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D35412 --HG-- extra : moz-landing-system : lando
This commit is contained in:
Родитель
ba5e16b74e
Коммит
0204171ff0
|
@ -549,12 +549,15 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Check if the csp-hash matches against the hash of the script or
|
||||||
|
// pseudoscript. If we can't get any content to check, block the script.
|
||||||
|
if (!content.IsEmpty() || !aContentOfPseudoScript.IsEmpty()) {
|
||||||
if (content.IsEmpty()) {
|
if (content.IsEmpty()) {
|
||||||
content = aContentOfPseudoScript;
|
content = aContentOfPseudoScript;
|
||||||
}
|
}
|
||||||
|
|
||||||
allowed =
|
allowed =
|
||||||
mPolicies[i]->allows(aContentType, CSP_HASH, content, aParserCreated);
|
mPolicies[i]->allows(aContentType, CSP_HASH, content, aParserCreated);
|
||||||
|
}
|
||||||
|
|
||||||
if (!allowed) {
|
if (!allowed) {
|
||||||
// policy is violoated: deny the load unless policy is report only and
|
// policy is violoated: deny the load unless policy is report only and
|
||||||
|
|
|
@ -0,0 +1,9 @@
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta http-equiv="Content-Security-Policy" content="script-src 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<a href="javascript:window.parent.postMessage({}, '*');">Click here</a>
|
||||||
|
</body>
|
||||||
|
</html>
|
|
@ -86,6 +86,7 @@ support-files =
|
||||||
file_bug1312272.html
|
file_bug1312272.html
|
||||||
file_bug1312272.js
|
file_bug1312272.js
|
||||||
file_bug1312272.html^headers^
|
file_bug1312272.html^headers^
|
||||||
|
file_bug1452037.html
|
||||||
file_policyuri_regression_from_multipolicy.html
|
file_policyuri_regression_from_multipolicy.html
|
||||||
file_policyuri_regression_from_multipolicy.html^headers^
|
file_policyuri_regression_from_multipolicy.html^headers^
|
||||||
file_policyuri_regression_from_multipolicy_policy
|
file_policyuri_regression_from_multipolicy_policy
|
||||||
|
@ -239,7 +240,7 @@ prefs =
|
||||||
[test_blob_data_schemes.html]
|
[test_blob_data_schemes.html]
|
||||||
[test_connect-src.html]
|
[test_connect-src.html]
|
||||||
[test_CSP.html]
|
[test_CSP.html]
|
||||||
[test_bug1388015.html]
|
[test_bug1452037.html]
|
||||||
[test_allow_https_schemes.html]
|
[test_allow_https_schemes.html]
|
||||||
[test_bug663567.html]
|
[test_bug663567.html]
|
||||||
[test_bug802872.html]
|
[test_bug802872.html]
|
||||||
|
|
|
@ -0,0 +1,40 @@
|
||||||
|
<!DOCTYPE HTML>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Test if "script-src: sha-... " Whitelists "javascript:" URIs</title>
|
||||||
|
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
|
||||||
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||||
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<iframe src="file_bug1452037.html"></iframe>
|
||||||
|
|
||||||
|
<script class="testbody">
|
||||||
|
SimpleTest.requestCompleteLog();
|
||||||
|
SimpleTest.waitForExplicitFinish();
|
||||||
|
|
||||||
|
let frame = document.querySelector("iframe");
|
||||||
|
|
||||||
|
window.addEventListener("message", (msg)=>{
|
||||||
|
ok(false, "The CSP did not block javascript:uri");
|
||||||
|
SimpleTest.finish();
|
||||||
|
}, false);
|
||||||
|
|
||||||
|
document.addEventListener("securitypolicyviolation",()=>{
|
||||||
|
ok(true, "The CSP did block javascript:uri");
|
||||||
|
SimpleTest.finish();
|
||||||
|
});
|
||||||
|
|
||||||
|
frame.addEventListener("load",()=>{
|
||||||
|
let link = frame.contentWindow.document.querySelector("a");
|
||||||
|
frame.contentWindow.document.addEventListener("securitypolicyviolation",()=>{
|
||||||
|
ok(true, "The CSP did block javascript:uri");
|
||||||
|
SimpleTest.finish();
|
||||||
|
})
|
||||||
|
link.click();
|
||||||
|
})
|
||||||
|
|
||||||
|
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
Загрузка…
Ссылка в новой задаче