mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1499354: Add object-src 'none' to the CSP of all about: pages. r=freddyb 

Differential Revision: https://phabricator.services.mozilla.com/D46950

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Christoph Kerschbaumer 2019-09-26 16:22:41 +00:00
Родитель 6f69ca7498
Коммит 30285b4a58
54 изменённых файлов: 61 добавлений и 55 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

2
browser/base/content/aboutFrameCrashed.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"
href="chrome://global/skin/in-content/info-pages.css"/> href="chrome://global/skin/in-content/info-pages.css"/>
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"

2
browser/base/content/aboutNetError.xhtml
Просмотреть файл

@ -19,7 +19,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title>&loadError.label;</title> <title>&loadError.label;</title>
<link rel="stylesheet" href="chrome://browser/skin/aboutNetError.css" type="text/css" media="all" /> <link rel="stylesheet" href="chrome://browser/skin/aboutNetError.css" type="text/css" media="all" />
<!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in <!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in

2
browser/base/content/aboutRestartRequired.xhtml
Просмотреть файл

@ -6,7 +6,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="restart-required-title"></title> <title data-l10n-id="restart-required-title"></title>
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"
href="chrome://browser/skin/aboutRestartRequired.css"/> href="chrome://browser/skin/aboutRestartRequired.css"/>

2
browser/base/content/aboutRobots.xhtml
Просмотреть файл

@ -5,7 +5,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="page-title"></title> <title data-l10n-id="page-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" media="all"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" media="all"/>
<link rel="icon" type="image/png" id="favicon" href="chrome://browser/content/robot.ico"/> <link rel="icon" type="image/png" id="favicon" href="chrome://browser/content/robot.ico"/>

2
browser/base/content/aboutTabCrashed.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"
href="chrome://global/skin/in-content/info-pages.css"/> href="chrome://global/skin/in-content/info-pages.css"/>
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"

2
browser/base/content/blockedSite.xhtml
Просмотреть файл

@ -6,7 +6,7 @@
- file, You can obtain one at http://mozilla.org/MPL/2.0/. --> - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<link rel="stylesheet" href="chrome://browser/skin/blockedSite.css" type="text/css" media="all" /> <link rel="stylesheet" href="chrome://browser/skin/blockedSite.css" type="text/css" media="all" />
<link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/blocklist_favicon.png"/> <link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/blocklist_favicon.png"/>
<link rel="localization" href="branding/brand.ftl"/> <link rel="localization" href="branding/brand.ftl"/>

2
browser/base/content/newInstallPage.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="connect-src https:; default-src chrome:"> <meta http-equiv="Content-Security-Policy" content="connect-src https:; default-src chrome:; object-src 'none'">
<meta name="referrer" content="no-referrer"> <meta name="referrer" content="no-referrer">
<link rel="stylesheet" type="text/css" href="chrome://global/skin/in-content/common.css"> <link rel="stylesheet" type="text/css" href="chrome://global/skin/in-content/common.css">
<link rel="stylesheet" type="text/css" href="chrome://browser/skin/newInstallPage.css"> <link rel="stylesheet" type="text/css" href="chrome://browser/skin/newInstallPage.css">

2
browser/components/aboutconfig/content/aboutconfig.html
Просмотреть файл

@ -5,7 +5,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:"> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'">
<meta charset="utf-8"> <meta charset="utf-8">
<link rel="stylesheet" media="screen, projection" type="text/css" <link rel="stylesheet" media="screen, projection" type="text/css"
href="chrome://global/skin/in-content/common.css"> href="chrome://global/skin/in-content/common.css">

2
browser/components/downloads/content/contentAreaDownloadsView.xul
Просмотреть файл

@ -24,7 +24,7 @@
<window id="contentAreaDownloadsView" <window id="contentAreaDownloadsView"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
title="&downloads.title;" title="&downloads.title;"
csp="default-src chrome:; script-src chrome: 'sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA=='; img-src chrome: moz-icon:;"> csp="default-src chrome:; script-src chrome: 'sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA=='; img-src chrome: moz-icon:; object-src 'none'">
<script src="chrome://global/content/globalOverlay.js"/> <script src="chrome://global/content/globalOverlay.js"/>
<script src="chrome://browser/content/downloads/contentAreaDownloadsView.js"/> <script src="chrome://browser/content/downloads/contentAreaDownloadsView.js"/>

2
browser/components/enterprisepolicies/content/aboutPolicies.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="about-policies-title"/> <title data-l10n-id="about-policies-title"/>
<link rel="stylesheet" href="chrome://browser/content/policies/aboutPolicies.css" type="text/css" /> <link rel="stylesheet" href="chrome://browser/content/policies/aboutPolicies.css" type="text/css" />
<link rel="localization" href="branding/brand.ftl"/> <link rel="localization" href="branding/brand.ftl"/>

2
browser/components/library/content/aboutLibrary.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title>about:library</title> <title>about:library</title>
<link rel="stylesheet" href="chrome://browser/skin/aboutLibrary.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://browser/skin/aboutLibrary.css" type="text/css" media="all"/>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/>

2
browser/components/migration/content/aboutWelcomeBack.xhtml
Просмотреть файл

@ -11,7 +11,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; img-src chrome: resource: data:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'" />
<title data-l10n-id="welcome-back-tab-title"></title> <title data-l10n-id="welcome-back-tab-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/>
<link rel="stylesheet" href="chrome://browser/skin/aboutWelcomeBack.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://browser/skin/aboutWelcomeBack.css" type="text/css" media="all"/>

2
browser/components/pocket/content/panels/saved.html
Просмотреть файл

@ -2,7 +2,7 @@
<html> <html>
<head> <head>
<meta charset="utf-8"> <meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<base href="chrome://pocket/content/panels/"> <base href="chrome://pocket/content/panels/">
<title>Pocket: Page Saved</title> <title>Pocket: Page Saved</title>
<link rel="stylesheet" href="css/normalize.css"> <link rel="stylesheet" href="css/normalize.css">

2
browser/components/pocket/content/panels/signup.html
Просмотреть файл

@ -2,7 +2,7 @@
<html> <html>
<head> <head>
<meta charset="utf-8"> <meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<base href="chrome://pocket/content/panels/"> <base href="chrome://pocket/content/panels/">
<title>Pocket: Sign Up</title> <title>Pocket: Sign Up</title>
<link rel="stylesheet" href="css/normalize.css"> <link rel="stylesheet" href="css/normalize.css">

2
browser/components/preferences/in-content/preferences.xul
Просмотреть файл

@ -24,7 +24,7 @@
Additionally we should remove 'unsafe-inline' from style-src, see Bug 1579160 --> Additionally we should remove 'unsafe-inline' from style-src, see Bug 1579160 -->
<page xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" <page xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:html="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml"
csp="default-src chrome:; script-src chrome: 'sha512-X8+p/CqXeMdssOoFOf5RV+RpkvnN9pukQ20acGc7LqMgfYLW+lR0WAYT66OtSTpFHE/Qgx/ZCBs2RMc4QrA8FQ=='; img-src chrome: moz-icon: https:; style-src chrome: data: 'unsafe-inline'" csp="default-src chrome:; script-src chrome: 'sha512-X8+p/CqXeMdssOoFOf5RV+RpkvnN9pukQ20acGc7LqMgfYLW+lR0WAYT66OtSTpFHE/Qgx/ZCBs2RMc4QrA8FQ=='; img-src chrome: moz-icon: https:; style-src chrome: data: 'unsafe-inline'; object-src 'none'"
role="document" role="document"
data-l10n-id="pref-page" data-l10n-id="pref-page"
data-l10n-attrs="title"> data-l10n-attrs="title">

2
browser/components/privatebrowsing/content/aboutPrivateBrowsing.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" class="private"> <html xmlns="http://www.w3.org/1999/xhtml" class="private">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome: blob:"/> <meta http-equiv="Content-Security-Policy" content="default-src chrome: blob:; object-src 'none'"/>
<link rel="icon" type="image/png" href="chrome://browser/skin/privatebrowsing/favicon.svg"/> <link rel="icon" type="image/png" href="chrome://browser/skin/privatebrowsing/favicon.svg"/>
<link rel="stylesheet" href="chrome://browser/content/aboutPrivateBrowsing.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://browser/content/aboutPrivateBrowsing.css" type="text/css" media="all"/>
<link rel="stylesheet" href="chrome://browser/skin/privatebrowsing/aboutPrivateBrowsing.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://browser/skin/privatebrowsing/aboutPrivateBrowsing.css" type="text/css" media="all"/>

2
browser/components/protections/content/protections.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta charset="utf-8"> <meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="default-src chrome: blob:"> <meta http-equiv="Content-Security-Policy" content="default-src chrome: blob:; object-src 'none'">
<link rel="localization" href="browser/branding/brandings.ftl"/> <link rel="localization" href="browser/branding/brandings.ftl"/>
<link rel="localization" href="branding/brand.ftl"/> <link rel="localization" href="branding/brand.ftl"/>
<link rel="localization" href="browser/branding/sync-brand.ftl"> <link rel="localization" href="browser/branding/sync-brand.ftl">

2
browser/components/sessionstore/content/aboutSessionRestore.xhtml
Просмотреть файл

@ -11,7 +11,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; img-src chrome: resource: data:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'" />
<title data-l10n-id="restore-page-tab-title"></title> <title data-l10n-id="restore-page-tab-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/>
<link rel="stylesheet" href="chrome://browser/skin/aboutSessionRestore.css" type="text/css" media="all"/> <link rel="stylesheet" href="chrome://browser/skin/aboutSessionRestore.css" type="text/css" media="all"/>

2
browser/extensions/webcompat/manifest.json
Просмотреть файл

@ -46,7 +46,7 @@
} }
}, },
"content_security_policy": "script-src 'self' 'sha256-MmZkN2QaIHhfRWPZ8TVRjijTn5Ci1iEabtTEWrt9CCo='; default-src 'self'; base-uri moz-extension://*;", "content_security_policy": "script-src 'self' 'sha256-MmZkN2QaIHhfRWPZ8TVRjijTn5Ci1iEabtTEWrt9CCo='; default-src 'self'; base-uri moz-extension://*; object-src 'none';",
"permissions": [ "permissions": [
"webRequest", "webRequest",

2
devtools/client/aboutdebugging/index.html
Просмотреть файл

@ -7,7 +7,7 @@
<meta charset="utf-8" /> <meta charset="utf-8" />
<title>Debugging</title> <title>Debugging</title>
<meta http-equiv="Content-Security-Policy" <meta http-equiv="Content-Security-Policy"
content="default-src chrome: resource:; img-src data: chrome: resource: https:" /> content="default-src chrome: resource:; img-src data: chrome: resource: https:; object-src 'none'" />
<link rel="icon" type="image/png" href="chrome://browser/skin/developer.svg"> <link rel="icon" type="image/png" href="chrome://browser/skin/developer.svg">
<link rel="stylesheet" href="chrome://devtools/content/aboutdebugging/aboutdebugging.css"/> <link rel="stylesheet" href="chrome://devtools/content/aboutdebugging/aboutdebugging.css"/>
<script src="resource://devtools/client/aboutdebugging/initializer.js"></script> <script src="resource://devtools/client/aboutdebugging/initializer.js"></script>

2
devtools/client/framework/toolbox.xul
Просмотреть файл

@ -16,7 +16,7 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:html="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml"
csp="default-src chrome: resource:; img-src chrome: resource: data:;"> csp="default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'">
<linkset> <linkset>
<html:link rel="localization" href="devtools/tooltips.ftl"/> <html:link rel="localization" href="devtools/tooltips.ftl"/>
</linkset> </linkset>

2
devtools/docs/frontend/csp.md
Просмотреть файл

@ -5,7 +5,7 @@ The DevTools toolbox is loaded in an iframe pointing to about:devtools-toolbox.
The current policy for about:devtools-toolbox is: The current policy for about:devtools-toolbox is:
``` ```
default-src chrome: resource:; img-src chrome: resource: data:; default-src chrome: resource:; img-src chrome: resource: data:; object-src 'none'
``` ```
This means: This means:

2
devtools/startup/aboutdevtools/aboutdevtools.xhtml
Просмотреть файл

@ -9,7 +9,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" dir="&locale.dir;"> <html xmlns="http://www.w3.org/1999/xhtml" dir="&locale.dir;">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="head-title"></title> <title data-l10n-id="head-title"></title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>a <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>a
<link rel="stylesheet" href="chrome://global/skin/in-content/common.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/in-content/common.css" type="text/css"/>

2
docshell/resources/content/netError.xhtml
Просмотреть файл

@ -22,7 +22,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title>&loadError.label;</title> <title>&loadError.label;</title>
<link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all" /> <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all" />
<!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in <!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in

10
dom/security/nsContentSecurityUtils.cpp
Просмотреть файл

@ -416,7 +416,8 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) {
// which allows us to apply a strong CSP omitting 'unsafe-inline'. Ideally, // which allows us to apply a strong CSP omitting 'unsafe-inline'. Ideally,
// the CSP allows precisely the resources that need to be loaded; but it // the CSP allows precisely the resources that need to be loaded; but it
// should at least be as strong as: // should at least be as strong as:
// <meta http-equiv="Content-Security-Policy" content="default-src chrome:"/> // <meta http-equiv="Content-Security-Policy" content="default-src chrome:;
// object-src 'none'"/>
// Check if we should skip the assertion // Check if we should skip the assertion
if (Preferences::GetBool("csp.skip_about_page_has_csp_assert")) { if (Preferences::GetBool("csp.skip_about_page_has_csp_assert")) {
@ -431,6 +432,7 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) {
nsCOMPtr<nsIContentSecurityPolicy> csp = aDocument->GetCsp(); nsCOMPtr<nsIContentSecurityPolicy> csp = aDocument->GetCsp();
bool foundDefaultSrc = false; bool foundDefaultSrc = false;
bool foundObjectSrc = false;
if (csp) { if (csp) {
uint32_t policyCount = 0; uint32_t policyCount = 0;
csp->GetPolicyCount(&policyCount); csp->GetPolicyCount(&policyCount);
@ -439,7 +441,9 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) {
csp->GetPolicyString(i, parsedPolicyStr); csp->GetPolicyString(i, parsedPolicyStr);
if (parsedPolicyStr.Find("default-src") >= 0) { if (parsedPolicyStr.Find("default-src") >= 0) {
foundDefaultSrc = true; foundDefaultSrc = true;
break; }
if (parsedPolicyStr.Find("object-src 'none'") >= 0) {
foundObjectSrc = true;
} }
} }
} }
@ -482,5 +486,7 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) {
MOZ_ASSERT(foundDefaultSrc, MOZ_ASSERT(foundDefaultSrc,
"about: page must contain a CSP including default-src"); "about: page must contain a CSP including default-src");
MOZ_ASSERT(foundObjectSrc,
"about: page must contain a CSP denying object-src");
} }
#endif #endif

2
dom/tests/browser/file_load_module_script.html
Просмотреть файл

@ -1,7 +1,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:"/> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'"/>
<script type="module" src="chrome://mochitests/content/browser/dom/tests/browser/file_module_loaded.js"></script> <script type="module" src="chrome://mochitests/content/browser/dom/tests/browser/file_module_loaded.js"></script>
</head> </head>
<body></body> <body></body>

2
mobile/android/extensions/webcompat/manifest.json
Просмотреть файл

@ -46,7 +46,7 @@
} }
}, },
"content_security_policy": "script-src 'self' 'sha256-MmZkN2QaIHhfRWPZ8TVRjijTn5Ci1iEabtTEWrt9CCo='; default-src 'self'; base-uri moz-extension://*;", "content_security_policy": "script-src 'self' 'sha256-MmZkN2QaIHhfRWPZ8TVRjijTn5Ci1iEabtTEWrt9CCo='; default-src 'self'; base-uri moz-extension://*; object-src 'none'",
"permissions": [ "permissions": [
"webRequest", "webRequest",

2
netwerk/protocol/about/nsAboutCache.cpp
Просмотреть файл

@ -87,7 +87,7 @@ nsresult nsAboutCache::Channel::Init(nsIURI* aURI, nsILoadInfo* aLoadInfo) {
" <title>Network Cache Storage Information</title>\n" " <title>Network Cache Storage Information</title>\n"
" <meta charset=\"utf-8\">\n" " <meta charset=\"utf-8\">\n"
" <meta http-equiv=\"Content-Security-Policy\" content=\"default-src " " <meta http-equiv=\"Content-Security-Policy\" content=\"default-src "
"chrome:\"/>\n" "chrome:; object-src 'none'\"/>\n"
" <link rel=\"stylesheet\" href=\"chrome://global/skin/about.css\"/>\n" " <link rel=\"stylesheet\" href=\"chrome://global/skin/about.css\"/>\n"
" <link rel=\"stylesheet\" " " <link rel=\"stylesheet\" "
"href=\"chrome://global/skin/aboutCache.css\"/>\n" "href=\"chrome://global/skin/aboutCache.css\"/>\n"

2
netwerk/protocol/about/nsAboutCacheEntry.cpp
Просмотреть файл

@ -144,7 +144,7 @@ nsresult nsAboutCacheEntry::Channel::GetContentStream(nsIURI* uri,
"<html>\n" "<html>\n"
"<head>\n" "<head>\n"
" <meta http-equiv=\"Content-Security-Policy\" content=\"default-src " " <meta http-equiv=\"Content-Security-Policy\" content=\"default-src "
"chrome:\" />\n" "chrome:; object-src 'none'\" />\n"
" <title>Cache entry information</title>\n" " <title>Cache entry information</title>\n"
" <link rel=\"stylesheet\" " " <link rel=\"stylesheet\" "
"href=\"chrome://global/skin/about.css\" type=\"text/css\"/>\n" "href=\"chrome://global/skin/about.css\" type=\"text/css\"/>\n"

2
testing/mochitest/tests/browser/dummy.html
Просмотреть файл

@ -1,6 +1,6 @@
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'"></meta> <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'"></meta>
<title>This is a dummy page</title> <title>This is a dummy page</title>
<meta charset="utf-8"> <meta charset="utf-8">
<body>This is a dummy page</body> <body>This is a dummy page</body>

2
toolkit/components/aboutcheckerboard/content/aboutCheckerboard.xhtml
Просмотреть файл

@ -6,7 +6,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<meta name="viewport" content="width=device-width"/> <meta name="viewport" content="width=device-width"/>
<title>Checkerboard Analyzer</title> <title>Checkerboard Analyzer</title>
<link rel="stylesheet" href="chrome://global/content/aboutCheckerboard.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/content/aboutCheckerboard.css" type="text/css"/>

2
toolkit/components/aboutmemory/content/aboutMemory.xhtml
Просмотреть файл

@ -16,7 +16,7 @@
--> -->
<html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<meta name="viewport" content="width=device-width"/> <meta name="viewport" content="width=device-width"/>
<title>Memory Analyzer</title> <title>Memory Analyzer</title>
<link rel="stylesheet" href="chrome://global/skin/aboutMemory.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/aboutMemory.css" type="text/css"/>

2
toolkit/components/aboutperformance/content/aboutPerformance.xhtml
Просмотреть файл

@ -6,7 +6,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:;img-src data:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:;img-src data:; object-src 'none'" />
<title data-l10n-id="about-performance-title"/> <title data-l10n-id="about-performance-title"/>
<link rel="icon" type="image/svg+xml" id="favicon" <link rel="icon" type="image/svg+xml" id="favicon"
href="chrome://global/skin/icons/performance.svg"/> href="chrome://global/skin/icons/performance.svg"/>

2
toolkit/components/certviewer/content/certviewer.html
Просмотреть файл

@ -7,7 +7,7 @@
<html> <html>
<head> <head>
<meta name="viewport" content="width=device-width" /> <meta name="viewport" content="width=device-width" />
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<link rel="localization" href="toolkit/about/certviewer.ftl"> <link rel="localization" href="toolkit/about/certviewer.ftl">
<link rel="localization" href="branding/brand.ftl"> <link rel="localization" href="branding/brand.ftl">
<script defer="defer" src="chrome://global/content/certviewer/pvutils_bundle.js"></script> <script defer="defer" src="chrome://global/content/certviewer/pvutils_bundle.js"></script>

2
toolkit/components/normandy/content/about-studies/about-studies.html
Просмотреть файл

@ -5,7 +5,7 @@
<html> <html>
<head> <head>
<meta charset="utf-8"> <meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="default-src chrome:; script-src resource:; style-src resource: chrome:"/> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; script-src resource:; style-src resource: chrome:; object-src 'none'"/>
<title>about:studies</title> <title>about:studies</title>
<link rel="stylesheet" href="chrome://global/skin/global.css"> <link rel="stylesheet" href="chrome://global/skin/global.css">
<link rel="stylesheet" href="chrome://global/skin/in-content/common.css"> <link rel="stylesheet" href="chrome://global/skin/in-content/common.css">

2
toolkit/components/reader/content/aboutReader.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:; img-src data: *; media-src *" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; img-src data: *; media-src *; object-src 'none'" />
<meta content="text/html; charset=UTF-8" http-equiv="content-type" /> <meta content="text/html; charset=UTF-8" http-equiv="content-type" />
<meta name="viewport" content="width=device-width; user-scalable=0" /> <meta name="viewport" content="width=device-width; user-scalable=0" />
<link rel="stylesheet" href="chrome://global/skin/aboutReader.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/aboutReader.css" type="text/css"/>

2
toolkit/components/viewconfig/content/config.xul
Просмотреть файл

@ -9,7 +9,7 @@
<?xml-stylesheet href="chrome://global/skin/config.css" type="text/css"?> <?xml-stylesheet href="chrome://global/skin/config.css" type="text/css"?>
<window id="config" <window id="config"
csp="default-src chrome:" csp="default-src chrome:; object-src 'none'"
data-l10n-id="config-window" data-l10n-id="config-window"
aria-describedby="warningTitle warningText" aria-describedby="warningTitle warningText"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

2
toolkit/content/aboutAbout.xhtml
Просмотреть файл

@ -7,7 +7,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="about-about-title"></title> <title data-l10n-id="about-about-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/>
<link rel="localization" href="toolkit/about/aboutAbout.ftl"/> <link rel="localization" href="toolkit/about/aboutAbout.ftl"/>

2
toolkit/content/aboutNetworking.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="title"/> <title data-l10n-id="title"/>
<link rel="stylesheet" href="chrome://mozapps/skin/aboutNetworking.css" type="text/css" /> <link rel="stylesheet" href="chrome://mozapps/skin/aboutNetworking.css" type="text/css" />
<script src="chrome://global/content/aboutNetworking.js" /> <script src="chrome://global/content/aboutNetworking.js" />

2
toolkit/content/aboutProfiles.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="profiles-title"></title> <title data-l10n-id="profiles-title"></title>
<link rel="icon" type="image/png" id="favicon" href="chrome://branding/content/icon32.png" /> <link rel="icon" type="image/png" id="favicon" href="chrome://branding/content/icon32.png" />
<link rel="stylesheet" href="chrome://mozapps/skin/aboutProfiles.css" type="text/css" /> <link rel="stylesheet" href="chrome://mozapps/skin/aboutProfiles.css" type="text/css" />

2
toolkit/content/aboutRights-unbranded.xhtml
Просмотреть файл

@ -11,7 +11,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="rights-title"></title> <title data-l10n-id="rights-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/>
<link rel="localization" href="branding/brand.ftl"/> <link rel="localization" href="branding/brand.ftl"/>

2
toolkit/content/aboutRights.xhtml
Просмотреть файл

@ -11,7 +11,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="rights-title"></title> <title data-l10n-id="rights-title"></title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"/>
<link rel="stylesheet" href="chrome://global/skin/aboutRights.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/skin/aboutRights.css" type="text/css"/>

2
toolkit/content/aboutServiceWorkers.xhtml
Просмотреть файл

@ -10,7 +10,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="about-service-workers-title"></title> <title data-l10n-id="about-service-workers-title"></title>
<link rel="stylesheet" href="chrome://global/skin/about.css" type="text/css" /> <link rel="stylesheet" href="chrome://global/skin/about.css" type="text/css" />
<link rel="stylesheet" href="chrome://mozapps/skin/aboutServiceWorkers.css" type="text/css" /> <link rel="stylesheet" href="chrome://mozapps/skin/aboutServiceWorkers.css" type="text/css" />

2
toolkit/content/aboutSupport.xhtml
Просмотреть файл

@ -11,7 +11,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="page-title"/> <title data-l10n-id="page-title"/>
<link rel="icon" type="image/png" id="favicon" <link rel="icon" type="image/png" id="favicon"

2
toolkit/content/aboutTelemetry.xhtml
Просмотреть файл

@ -8,7 +8,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; object-src 'none'" />
<title data-l10n-id="about-telemetry-page-title"></title> <title data-l10n-id="about-telemetry-page-title"></title>
<link rel="stylesheet" href="chrome://global/content/aboutTelemetry.css" <link rel="stylesheet" href="chrome://global/content/aboutTelemetry.css"
type="text/css"/> type="text/css"/>

2
toolkit/content/aboutUrlClassifier.xhtml
Просмотреть файл

@ -10,7 +10,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<title data-l10n-id="url-classifier-title"></title> <title data-l10n-id="url-classifier-title"></title>
<link rel="stylesheet" href="chrome://global/content/aboutUrlClassifier.css" type="text/css"/> <link rel="stylesheet" href="chrome://global/content/aboutUrlClassifier.css" type="text/css"/>
<link rel="localization" href="toolkit/about/url-classifier.ftl"/> <link rel="localization" href="toolkit/about/url-classifier.ftl"/>

2
toolkit/content/aboutwebrtc/aboutWebrtc.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<meta charset="utf-8" /> <meta charset="utf-8" />
<title>about:webrtc</title> <title>about:webrtc</title>
<link rel="stylesheet" type="text/css" media="all" <link rel="stylesheet" type="text/css" media="all"

2
toolkit/content/buildconfig.html
Просмотреть файл

@ -7,7 +7,7 @@
#include @TOPOBJDIR@/source-repo.h #include @TOPOBJDIR@/source-repo.h
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:; object-src 'none'" />
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width; user-scalable=false;"> <meta name="viewport" content="width=device-width; user-scalable=false;">
<title>Build Configuration</title> <title>Build Configuration</title>

2
toolkit/content/license.html
Просмотреть файл

@ -5,7 +5,7 @@
<html lang="en"> <html lang="en">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:; img-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:; img-src chrome:; object-src 'none'" />
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"> <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
<title>Licenses</title> <title>Licenses</title>
<link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css"> <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css">

2
toolkit/content/mozilla.xhtml
Просмотреть файл

@ -12,7 +12,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src chrome:; object-src 'none'" />
<meta charset='utf-8' /> <meta charset='utf-8' />
<title>&mozilla.title.11.14;</title> <title>&mozilla.title.11.14;</title>
<link rel="stylesheet" href="chrome://global/content/aboutMozilla.css"/>" type="text/css"/> <link rel="stylesheet" href="chrome://global/content/aboutMozilla.css"/>" type="text/css"/>

2
toolkit/content/plugins.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome: resource:; object-src 'none'" />
<title data-l10n-id="title-label"></title> <title data-l10n-id="title-label"></title>
<link rel="stylesheet" type="text/css" href="chrome://global/content/plugins.css"> <link rel="stylesheet" type="text/css" href="chrome://global/content/plugins.css">
<link rel="stylesheet" type="text/css" href="chrome://global/skin/plugins.css"> <link rel="stylesheet" type="text/css" href="chrome://global/skin/plugins.css">

2
toolkit/crashreporter/content/crashes.xhtml
Просмотреть файл

@ -6,7 +6,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"> <html xmlns="http://www.w3.org/1999/xhtml">
<head> <head>
<meta http-equiv="Content-Security-Policy" content="default-src chrome:" /> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; object-src 'none'" />
<link rel="localization" href="crashreporter/aboutcrashes.ftl"/> <link rel="localization" href="crashreporter/aboutcrashes.ftl"/>
<link rel="stylesheet" type="text/css" href="chrome://global/content/crashes.css"/> <link rel="stylesheet" type="text/css" href="chrome://global/content/crashes.css"/>
<link rel="stylesheet" media="screen, projection" type="text/css" <link rel="stylesheet" media="screen, projection" type="text/css"

2
toolkit/mozapps/extensions/content/aboutaddons.html
Просмотреть файл

@ -6,7 +6,7 @@
<html> <html>
<head> <head>
<!-- Bug 1571346 Remove 'unsafe-inline' from style-src within about:addons --> <!-- Bug 1571346 Remove 'unsafe-inline' from style-src within about:addons -->
<meta http-equiv="Content-Security-Policy" content="default-src chrome:; script-src chrome:; style-src chrome: 'unsafe-inline'; img-src chrome: file: jar: https: http:; connect-src chrome: data: https: http:"> <meta http-equiv="Content-Security-Policy" content="default-src chrome:; script-src chrome:; style-src chrome: 'unsafe-inline'; img-src chrome: file: jar: https: http:; connect-src chrome: data: https: http:; object-src 'none'">
<link rel="stylesheet" href="chrome://global/content/tabprompts.css"> <link rel="stylesheet" href="chrome://global/content/tabprompts.css">
<link rel="stylesheet" href="chrome://global/skin/tabprompts.css"> <link rel="stylesheet" href="chrome://global/skin/tabprompts.css">

2
toolkit/mozapps/extensions/content/extensions.xul
Просмотреть файл

@ -21,7 +21,7 @@
--> -->
<page xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" <page xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xhtml="http://www.w3.org/1999/xhtml"
csp="default-src chrome:; frame-src chrome: data: http: https:; script-src chrome: 'sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA==' 'sha512-kSDNX67wegjpcf8CSj/L6h46a0QUKm2CyijGxC5PhSWVvPU9gdd28QVBBFq9t8N5UGKUFdDcZsjYbGSlYG0y3g==';" csp="default-src chrome:; frame-src chrome: data: http: https:; script-src chrome: 'sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA==' 'sha512-kSDNX67wegjpcf8CSj/L6h46a0QUKm2CyijGxC5PhSWVvPU9gdd28QVBBFq9t8N5UGKUFdDcZsjYbGSlYG0y3g=='; object-src 'none'"
id="addons-page" data-l10n-id="addons-window" id="addons-page" data-l10n-id="addons-window"
role="application" windowtype="Addons:Manager"> role="application" windowtype="Addons:Manager">