mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1452037 - Fix Whitelisting of javascript-uris with csp hash r=ckerschb 

Differential Revision: https://phabricator.services.mozilla.com/D35412

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Sebastian Streich 2019-07-16 13:25:05 +00:00
Родитель ba5e16b74e
Коммит 0204171ff0
4 изменённых файлов: 59 добавлений и 6 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

13
dom/security/nsCSPContext.cpp
Просмотреть файл

@ -549,13 +549,16 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
} }
} }
if (content.IsEmpty()) { // Check if the csp-hash matches against the hash of the script or
content = aContentOfPseudoScript; // pseudoscript. If we can't get any content to check, block the script.
if (!content.IsEmpty() || !aContentOfPseudoScript.IsEmpty()) {
if (content.IsEmpty()) {
content = aContentOfPseudoScript;
}
allowed =
mPolicies[i]->allows(aContentType, CSP_HASH, content, aParserCreated);
} }
allowed =
mPolicies[i]->allows(aContentType, CSP_HASH, content, aParserCreated);
if (!allowed) { if (!allowed) {
// policy is violoated: deny the load unless policy is report only and // policy is violoated: deny the load unless policy is report only and
// report the violation. // report the violation.

9
dom/security/test/csp/file_bug1452037.html Normal file
Просмотреть файл

@ -0,0 +1,9 @@
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="script-src 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='">
</head>
<body>
<a href="javascript:window.parent.postMessage({}, '*');">Click here</a>
</body>
</html>

3
dom/security/test/csp/mochitest.ini
Просмотреть файл

@ -86,6 +86,7 @@ support-files =
file_bug1312272.html file_bug1312272.html
file_bug1312272.js file_bug1312272.js
file_bug1312272.html^headers^ file_bug1312272.html^headers^
file_bug1452037.html
file_policyuri_regression_from_multipolicy.html file_policyuri_regression_from_multipolicy.html
file_policyuri_regression_from_multipolicy.html^headers^ file_policyuri_regression_from_multipolicy.html^headers^
file_policyuri_regression_from_multipolicy_policy file_policyuri_regression_from_multipolicy_policy
@ -239,7 +240,7 @@ prefs =
[test_blob_data_schemes.html] [test_blob_data_schemes.html]
[test_connect-src.html] [test_connect-src.html]
[test_CSP.html] [test_CSP.html]
[test_bug1388015.html] [test_bug1452037.html]
[test_allow_https_schemes.html] [test_allow_https_schemes.html]
[test_bug663567.html] [test_bug663567.html]
[test_bug802872.html] [test_bug802872.html]

40
dom/security/test/csp/test_bug1452037.html Normal file
Просмотреть файл

@ -0,0 +1,40 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Test if "script-src: sha-... " Whitelists "javascript:" URIs</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe src="file_bug1452037.html"></iframe>
<script class="testbody">
SimpleTest.requestCompleteLog();
SimpleTest.waitForExplicitFinish();
let frame = document.querySelector("iframe");
window.addEventListener("message", (msg)=>{
ok(false, "The CSP did not block javascript:uri");
SimpleTest.finish();
}, false);
document.addEventListener("securitypolicyviolation",()=>{
ok(true, "The CSP did block javascript:uri");
SimpleTest.finish();
});
frame.addEventListener("load",()=>{
let link = frame.contentWindow.document.querySelector("a");
frame.contentWindow.document.addEventListener("securitypolicyviolation",()=>{
ok(true, "The CSP did block javascript:uri");
SimpleTest.finish();
})
link.click();
})
</script>
</body>
</html>