Backed out changeset 59fe98b41d80 (bug 1374612) for WPT failures in /html/dom/idlharness.https.html. CLOSED TREE

--HG--
extra : amend_source : a537237327643c365f02c0bfbed643b0d54cf1d5

dom/base/Document.cpp

@@ -1255,7 +1255,6 @@ Document::Document(const char* aContentType)
       mHasCSP(false),
       mHasUnsafeEvalCSP(false),
       mHasUnsafeInlineCSP(false),
-      mHasCSPDeliveredThroughHeader(false),
       mBFCacheDisallowed(false),
       mHasHadDefaultView(false),
       mStyleSheetChangeEventsEnabled(false),
@@ -3394,7 +3393,6 @@ nsresult Document::InitCSP(nsIChannel* aChannel) {
 
   // ----- if there's a full-strength CSP header, apply it.
   if (!cspHeaderValue.IsEmpty()) {
-    mHasCSPDeliveredThroughHeader = true;
     rv = CSP_AppendCSPFromHeader(mCSP, cspHeaderValue, false);
     NS_ENSURE_SUCCESS(rv, rv);
   }

dom/base/Document.h

@@ -1116,14 +1116,6 @@ class Document : public nsINode,
     mHasUnsafeEvalCSP = aHasUnsafeEvalCSP;
   }
 
-  /**
-   * Returns true if the document holds a CSP
-   * delivered through an HTTP Header.
-   */
-  bool GetHasCSPDeliveredThroughHeader() {
-    return mHasCSPDeliveredThroughHeader;
-  }
-
   /**
    * Return a promise which resolves to the content blocking events.
    */
@@ -4425,9 +4417,6 @@ class Document : public nsINode,
   // True if a document load has a CSP with unsafe-inline attached.
   bool mHasUnsafeInlineCSP : 1;
 
-  // True if the document has a CSP delivered throuh a header
-  bool mHasCSPDeliveredThroughHeader : 1;
-
   // True if DisallowBFCaching has been called on this document.
   bool mBFCacheDisallowed : 1;
 

dom/base/nsINode.h

@@ -175,11 +175,8 @@ enum {
 
   NODE_HAS_BEEN_IN_UA_WIDGET = NODE_FLAG_BIT(15),
 
-  // Set if the node has a nonce value and a header delivered CSP.
-  NODE_HAS_NONCE_AND_HEADER_CSP = NODE_FLAG_BIT(16),
-
   // Remaining bits are node type specific.
-  NODE_TYPE_SPECIFIC_BITS_OFFSET = 17
+  NODE_TYPE_SPECIFIC_BITS_OFFSET = 16
 };
 
 // Make sure we have space for our bits

dom/html/HTMLLinkElement.cpp

@@ -473,10 +473,7 @@ Maybe<nsStyleLinkElement::SheetInfo> HTMLLinkElement::GetStyleSheetInfo() {
   referrerInfo->InitWithNode(this);
 
   nsAutoString nonce;
-  nsString* cspNonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
-  if (cspNonce) {
-    nonce = *cspNonce;
-  }
+  GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
 
   return Some(SheetInfo{
       *OwnerDoc(),

dom/html/nsGenericHTMLElement.cpp

@@ -109,15 +109,7 @@ nsresult nsGenericHTMLElement::CopyInnerTo(Element* aDst) {
 
   auto reparse = aDst->OwnerDoc() == OwnerDoc() ? ReparseAttributes::No
                                                 : ReparseAttributes::Yes;
-  nsresult rv = Element::CopyInnerTo(aDst, reparse);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // cloning a node must retain its internal nonce slot
-  nsString* nonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
-  if (nonce) {
-    static_cast<nsGenericHTMLElement*>(aDst)->SetNonce(*nonce);
-  }
-  return NS_OK;
+  return Element::CopyInnerTo(aDst, reparse);
 }
 
 static const nsAttrValue::EnumTable kDirTable[] = {
@@ -394,21 +386,6 @@ nsresult nsGenericHTMLElement::BindToTree(BindContext& aContext,
     aContext.OwnerDoc().ChangeContentEditableCount(this, +1);
   }
 
-  // Hide any nonce from the DOM, but keep the internal value of the
-  // nonce by copying and resetting the internal nonce value.
-  if (HasFlag(NODE_HAS_NONCE_AND_HEADER_CSP) && IsInComposedDoc() &&
-      OwnerDoc()->GetBrowsingContext()) {
-    nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
-        "nsGenericHTMLElement::ResetNonce::Runnable",
-        [self = RefPtr<nsGenericHTMLElement>(this)]() {
-          nsAutoString nonce;
-          self->GetNonce(nonce);
-          self->SetAttr(kNameSpaceID_None, nsGkAtoms::nonce, EmptyString(),
-                        true);
-          self->SetNonce(nonce);
-        }));
-  }
-
   // We need to consider a labels element is moved to another subtree
   // with different root, it needs to update labels list and its root
   // as well.
@@ -664,20 +641,6 @@ nsresult nsGenericHTMLElement::AfterSetAttr(
         }
       }
     }
-
-    // The nonce will be copied over to an internal slot and cleared from the
-    // Element within BindToTree to avoid CSS Selector nonce exfiltration if
-    // the CSP list contains a header-delivered CSP.
-    if (nsGkAtoms::nonce == aName) {
-      if (aValue) {
-        SetNonce(aValue->GetStringValue());
-        if (OwnerDoc()->GetHasCSPDeliveredThroughHeader()) {
-          SetFlags(NODE_HAS_NONCE_AND_HEADER_CSP);
-        }
-      } else {
-        RemoveNonce();
-      }
-    }
   }
 
   return nsGenericHTMLElementBase::AfterSetAttr(

dom/html/nsGenericHTMLElement.h

@@ -140,18 +140,6 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
     return false;
   }
 
-  void SetNonce(const nsAString& aNonce) {
-    SetProperty(nsGkAtoms::nonce, new nsString(aNonce),
-                nsINode::DeleteProperty<nsString>);
-  }
-  void RemoveNonce() { RemoveProperty(nsGkAtoms::nonce); }
-  void GetNonce(nsAString& aNonce) const {
-    nsString* cspNonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
-    if (cspNonce) {
-      aNonce = *cspNonce;
-    }
-  }
-
   /**
    * Returns the count of descendants (inclusive of this node) in
    * the uncomposed document that are explicitly set as editable.

dom/script/ScriptLoader.cpp

@@ -323,13 +323,11 @@ nsresult ScriptLoader::CheckContentPolicy(Document* aDocument,
   // snapshot the nonce at load start time for performing CSP checks
   if (contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_SCRIPT ||
       contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_MODULE) {
-    nsCOMPtr<nsINode> node = do_QueryInterface(aContext);
-    if (node) {
-      nsString* cspNonce =
-          static_cast<nsString*>(node->GetProperty(nsGkAtoms::nonce));
-      if (cspNonce) {
-        secCheckLoadInfo->SetCspNonce(*cspNonce);
-      }
+    nsCOMPtr<Element> element = do_QueryInterface(aContext);
+    if (element && element->IsHTMLElement()) {
+      nsAutoString cspNonce;
+      element->GetAttr(nsGkAtoms::nonce, cspNonce);
+      secCheckLoadInfo->SetCspNonce(cspNonce);
     }
   }
 
@@ -1324,13 +1322,12 @@ nsresult ScriptLoader::StartLoad(ScriptLoadRequest* aRequest) {
   // snapshot the nonce at load start time for performing CSP checks
   if (contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_SCRIPT ||
       contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_MODULE) {
-    if (context) {
-      nsString* cspNonce =
-          static_cast<nsString*>(context->GetProperty(nsGkAtoms::nonce));
-      if (cspNonce) {
-        nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
-        loadInfo->SetCspNonce(*cspNonce);
-      }
+    nsCOMPtr<Element> element = do_QueryInterface(context);
+    if (element && element->IsHTMLElement()) {
+      nsAutoString cspNonce;
+      element->GetAttr(nsGkAtoms::nonce, cspNonce);
+      nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
+      loadInfo->SetCspNonce(cspNonce);
     }
   }
 
@@ -1500,14 +1497,7 @@ static bool CSPAllowsInlineScript(nsIScriptElement* aElement,
   // query the nonce
   nsCOMPtr<Element> scriptContent = do_QueryInterface(aElement);
   nsAutoString nonce;
-  if (scriptContent) {
-    nsString* cspNonce =
-        static_cast<nsString*>(scriptContent->GetProperty(nsGkAtoms::nonce));
-    if (cspNonce) {
-      nonce = *cspNonce;
-    }
-  }
-
+  scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
   bool parserCreated =
       aElement->GetParserCreated() != mozilla::dom::NOT_FROM_PARSER;
 

dom/svg/SVGElement.cpp

@@ -104,18 +104,6 @@ JSObject* SVGElement::WrapNode(JSContext* aCx,
   return SVGElement_Binding::Wrap(aCx, this, aGivenProto);
 }
 
-nsresult SVGElement::CopyInnerTo(mozilla::dom::Element* aDest) {
-  nsresult rv = Element::CopyInnerTo(aDest);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // cloning a node must retain its internal nonce slot
-  nsString* nonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
-  if (nonce) {
-    static_cast<SVGElement*>(aDest)->SetNonce(*nonce);
-  }
-  return NS_OK;
-}
-
 //----------------------------------------------------------------------
 // SVGElement methods
 
@@ -245,21 +233,6 @@ nsresult SVGElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   nsresult rv = SVGElementBase::BindToTree(aContext, aParent);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Hide any nonce from the DOM, but keep the internal value of the
-  // nonce by copying and resetting the internal nonce value.
-  if (HasFlag(NODE_HAS_NONCE_AND_HEADER_CSP) && IsInComposedDoc() &&
-      OwnerDoc()->GetBrowsingContext()) {
-    nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
-        "SVGElement::ResetNonce::Runnable",
-        [self = RefPtr<SVGElement>(this)]() {
-          nsAutoString nonce;
-          self->GetNonce(nonce);
-          self->SetAttr(kNameSpaceID_None, nsGkAtoms::nonce, EmptyString(),
-                        true);
-          self->SetNonce(nonce);
-        }));
-  }
-
   if (!MayHaveStyle()) {
     return NS_OK;
   }
@@ -316,20 +289,6 @@ nsresult SVGElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
     SetEventHandler(GetEventNameForAttr(aName), aValue->GetStringValue());
   }
 
-  // The nonce will be copied over to an internal slot and cleared from the
-  // Element within BindToTree to avoid CSS Selector nonce exfiltration if
-  // the CSP list contains a header-delivered CSP.
-  if (nsGkAtoms::nonce == aName && kNameSpaceID_None == aNamespaceID) {
-    if (aValue) {
-      SetNonce(aValue->GetStringValue());
-      if (OwnerDoc()->GetHasCSPDeliveredThroughHeader()) {
-        SetFlags(NODE_HAS_NONCE_AND_HEADER_CSP);
-      }
-    } else {
-      RemoveNonce();
-    }
-  }
-
   return SVGElementBase::AfterSetAttr(aNamespaceID, aName, aValue, aOldValue,
                                       aSubjectPrincipal, aNotify);
 }

dom/svg/SVGElement.h

@@ -78,9 +78,6 @@ class SVGElement : public SVGElementBase  // nsIContent
   virtual nsresult Clone(mozilla::dom::NodeInfo*,
                          nsINode** aResult) const MOZ_MUST_OVERRIDE override;
 
-  // From Element
-  nsresult CopyInnerTo(mozilla::dom::Element* aDest);
-
   // nsISupports
   NS_INLINE_DECL_REFCOUNTING_INHERITED(SVGElement, SVGElementBase)
 
@@ -88,18 +85,6 @@ class SVGElement : public SVGElementBase  // nsIContent
 
   void DidAnimateClass();
 
-  void SetNonce(const nsAString& aNonce) {
-    SetProperty(nsGkAtoms::nonce, new nsString(aNonce),
-                nsINode::DeleteProperty<nsString>);
-  }
-  void RemoveNonce() { RemoveProperty(nsGkAtoms::nonce); }
-  void GetNonce(nsAString& aNonce) const {
-    nsString* cspNonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
-    if (cspNonce) {
-      aNonce = *cspNonce;
-    }
-  }
-
   // nsIContent interface methods
 
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;

dom/webidl/HTMLElement.webidl

@@ -51,8 +51,6 @@ interface HTMLElement : Element {
   [CEReactions, SetterThrows, Pure]
            attribute boolean spellcheck;
 
-  attribute DOMString nonce;
-
   // command API
   //readonly attribute DOMString? commandType;
   //readonly attribute DOMString? commandLabel;

dom/webidl/SVGElement.webidl

@@ -19,8 +19,6 @@ interface SVGElement : Element {
 
   readonly attribute SVGSVGElement? ownerSVGElement;
   readonly attribute SVGElement? viewportElement;
-
-  attribute DOMString nonce;
 };
 
 SVGElement includes GlobalEventHandlers;

layout/style/Loader.cpp

@@ -1402,14 +1402,13 @@ nsresult Loader::LoadSheet(SheetLoadData& aLoadData, SheetState aSheetState,
 
     // snapshot the nonce at load start time for performing CSP checks
     if (contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_STYLESHEET) {
-      if (aLoadData.mRequestingNode) {
+      nsCOMPtr<Element> element = do_QueryInterface(aLoadData.mRequestingNode);
+      if (element && element->IsHTMLElement()) {
+        nsAutoString cspNonce;
         // TODO(bug 1607009) move to SheetLoadData
-        nsString* cspNonce = static_cast<nsString*>(
-            aLoadData.mRequestingNode->GetProperty(nsGkAtoms::nonce));
-        if (cspNonce) {
-          nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
-          loadInfo->SetCspNonce(*cspNonce);
-        }
+        element->GetAttr(nsGkAtoms::nonce, cspNonce);
+        nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
+        loadInfo->SetCspNonce(cspNonce);
       }
     }
 
@@ -1535,14 +1534,13 @@ nsresult Loader::LoadSheet(SheetLoadData& aLoadData, SheetState aSheetState,
 
   // snapshot the nonce at load start time for performing CSP checks
   if (contentPolicyType == nsIContentPolicy::TYPE_INTERNAL_STYLESHEET) {
-    if (aLoadData.mRequestingNode) {
+    nsCOMPtr<Element> element = do_QueryInterface(aLoadData.mRequestingNode);
+    if (element && element->IsHTMLElement()) {
+      nsAutoString cspNonce;
       // TODO(bug 1607009) move to SheetLoadData
-      nsString* cspNonce = static_cast<nsString*>(
-          aLoadData.mRequestingNode->GetProperty(nsGkAtoms::nonce));
-      if (cspNonce) {
-        nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
-        loadInfo->SetCspNonce(*cspNonce);
-      }
+      element->GetAttr(nsGkAtoms::nonce, cspNonce);
+      nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
+      loadInfo->SetCspNonce(cspNonce);
     }
   }
 

layout/style/nsStyleUtil.cpp

@@ -309,11 +309,7 @@ bool nsStyleUtil::CSPAllowsInlineStyle(
   // query the nonce
   nsAutoString nonce;
   if (aElement && aElement->NodeInfo()->NameAtom() == nsGkAtoms::style) {
-    nsString* cspNonce =
-        static_cast<nsString*>(aElement->GetProperty(nsGkAtoms::nonce));
-    if (cspNonce) {
-      nonce = *cspNonce;
-    }
+    aElement->GetAttr(nsGkAtoms::nonce, nonce);
   }
 
   bool allowInlineStyle = true;

testing/web-platform/meta/content-security-policy/nonce-hiding/nonces.html.ini

@@ -0,0 +1,37 @@
+[nonces.html]
+  [Ensure that removal of content attribute does not affect IDL attribute for meh in HTML namespace]
+    expected: FAIL
+
+  [Ensure that removal of content attribute does not affect IDL attribute for div in HTML namespace]
+    expected: FAIL
+
+  [Ensure that removal of content attribute does not affect IDL attribute for meh in SVG namespace]
+    expected: FAIL
+
+  [Ensure that removal of content attribute does not affect IDL attribute for script in SVG namespace]
+    expected: FAIL
+
+  [Basic nonce tests for script in HTML namespace]
+    expected: FAIL
+
+  [Basic nonce tests for script in SVG namespace]
+    expected: FAIL
+
+  [Ensure that removal of content attribute does not affect IDL attribute for script in HTML namespace]
+    expected: FAIL
+
+  [Basic nonce tests for div in HTML namespace]
+    expected: FAIL
+
+  [Basic nonce tests for svg in SVG namespace]
+    expected: FAIL
+
+  [Basic nonce tests for meh in HTML namespace]
+    expected: FAIL
+
+  [Basic nonce tests for meh in SVG namespace]
+    expected: FAIL
+
+  [Ensure that removal of content attribute does not affect IDL attribute for svg in SVG namespace]
+    expected: FAIL
+

testing/web-platform/meta/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html.ini

@@ -0,0 +1,25 @@
+[script-nonces-hidden-meta.sub.html]
+  [Cloned node retains nonce.]
+    expected: FAIL
+
+  [createElement.nonce.]
+    expected: FAIL
+
+  [Writing 'nonce' content attribute.]
+    expected: FAIL
+
+  [Cloned node retains nonce when inserted.]
+    expected: FAIL
+
+  [Reading 'nonce' content attribute and IDL attribute.]
+    expected: FAIL
+
+  [Document-written script's nonce value.]
+    expected: FAIL
+
+  [setAttribute('nonce') overwrites '.nonce' upon insertion.]
+    expected: FAIL
+
+  [createElement.setAttribute.]
+    expected: FAIL
+

testing/web-platform/meta/content-security-policy/nonce-hiding/script-nonces-hidden.html.ini

@@ -0,0 +1,31 @@
+[script-nonces-hidden.html]
+  [Cloned node retains nonce.]
+    expected: FAIL
+
+  [createElement.nonce.]
+    expected: FAIL
+
+  [Writing 'nonce' content attribute.]
+    expected: FAIL
+
+  [Cloned node retains nonce when inserted.]
+    expected: FAIL
+
+  [Reading 'nonce' content attribute and IDL attribute.]
+    expected: FAIL
+
+  [Document-written script's nonce value.]
+    expected: FAIL
+
+  [setAttribute('nonce') overwrites '.nonce' upon insertion.]
+    expected: FAIL
+
+  [Custom elements expose the correct events.]
+    expected: FAIL
+
+  [Nonces don't leak via CSS side-channels.]
+    expected: FAIL
+
+  [createElement.setAttribute.]
+    expected: FAIL
+

testing/web-platform/meta/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub.html.ini

@@ -0,0 +1,19 @@
+[svgscript-nonces-hidden-meta.sub.html]
+  [Cloned node retains nonce.]
+    expected: FAIL
+
+  [Writing 'nonce' content attribute.]
+    expected: FAIL
+
+  [Cloned node retains nonce when inserted.]
+    expected: FAIL
+
+  [Reading 'nonce' content attribute and IDL attribute.]
+    expected: FAIL
+
+  [Document-written script's nonce value.]
+    expected: FAIL
+
+  [createElement.setAttribute.]
+    expected: FAIL
+

testing/web-platform/meta/content-security-policy/nonce-hiding/svgscript-nonces-hidden.html.ini

@@ -0,0 +1,19 @@
+[svgscript-nonces-hidden.html]
+  [Cloned node retains nonce.]
+    expected: FAIL
+
+  [Writing 'nonce' content attribute.]
+    expected: FAIL
+
+  [Cloned node retains nonce when inserted.]
+    expected: FAIL
+
+  [Reading 'nonce' content attribute and IDL attribute.]
+    expected: FAIL
+
+  [Document-written script's nonce value.]
+    expected: FAIL
+
+  [createElement.setAttribute.]
+    expected: FAIL
+