Bug 1497204: Apply Meta CSP to about:profiles. r=Gijs

Differential Revision: https://phabricator.services.mozilla.com/D36520 --HG-- extra : moz-landing-system : lando
2019-07-01 19:47:16 +00:00 · 2019-07-01 19:47:16 +00:00 · 4d8607bf1c
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@ -2512,7 +2512,7 @@ pref("security.dialog_enable_delay", 1000);
 pref("security.notification_enable_delay", 500);

 #if defined(DEBUG) && !defined(ANDROID)
-pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,addons,cache-entry,config,debugging,devtools,downloads,home,newtab,plugins,profiles,preferences,restartrequired,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,welcomeback");
+pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,addons,cache-entry,config,debugging,devtools,downloads,home,newtab,plugins,preferences,restartrequired,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,welcomeback");
 // the following prefs are for testing purposes only.
 pref("csp.overrule_about_uris_without_csp_whitelist", false);
 pref("csp.skip_about_page_has_csp_assert", false);
--- a/toolkit/content/aboutProfiles.xhtml
+++ b/toolkit/content/aboutProfiles.xhtml
@ -8,6 +8,7 @@

 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
+    <meta http-equiv="Content-Security-Policy" content="default-src chrome:" />
    <title data-l10n-id="profiles-title"></title>
    <link rel="icon" type="image/png" id="favicon" href="chrome://branding/content/icon32.png" />
    <link rel="stylesheet" href="chrome://mozapps/skin/aboutProfiles.css" type="text/css" />