From 595fee0d91295c6ac6cd1fab383921232bb438f1 Mon Sep 17 00:00:00 2001 From: Andrea Marchesini Date: Wed, 18 Jul 2018 16:49:18 +0200 Subject: [PATCH 01/14] Bug 1476280 - SecurityPolicyViolationEvent.blockedURI should contain the original URL in case of redirects, r=ckerschb --- dom/security/nsCSPContext.cpp | 150 ++++++++++-------- dom/security/nsCSPContext.h | 11 +- .../test/csp/test_blocked_uri_in_reports.html | 2 +- .../test/csp/test_report_for_import.html | 2 +- dom/security/test/unit/test_csp_reports.js | 4 +- .../media-src/media-src-7_1_2.sub.html.ini | 4 +- .../media-src/media-src-7_2_2.sub.html.ini | 4 +- .../media-src/media-src-7_3_2.sub.html.ini | 4 - .../media-src/media-src-blocked.sub.html.ini | 4 +- .../report-original-url.sub.html.ini | 5 +- .../reporting/report-strips-fragment.html.ini | 4 - ...double_policy_honor_whitelist.sub.html.ini | 3 +- .../inside-dedicated-worker.html.ini | 5 - .../inside-service-worker.https.html.ini | 5 - .../inside-shared-worker.html.ini | 5 - ...ross-origin-image-from-script.sub.html.ini | 4 - ...tion-block-cross-origin-image.sub.html.ini | 4 - ...ation-block-image-from-script.sub.html.ini | 4 - ...-src-redirect-upgrade-reporting.https.html | 6 +- .../support/inside-worker.sub.js | 13 ++ 20 files changed, 125 insertions(+), 118 deletions(-) delete mode 100644 testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini delete mode 100644 testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp index 8abeb782f4bc..2cc173ab933b 100644 --- a/dom/security/nsCSPContext.cpp +++ b/dom/security/nsCSPContext.cpp @@ -91,6 +91,29 @@ ValidateDirectiveName(const nsAString& aDirective) } #endif // DEBUG +static void +BlockedContentSourceToString(nsCSPContext::BlockedContentSource aSource, + nsACString& aString) +{ + switch (aSource) { + case nsCSPContext::BlockedContentSource::eUnknown: + aString.Truncate(); + break; + + case nsCSPContext::BlockedContentSource::eInline: + aString.AssignLiteral("inline"); + break; + + case nsCSPContext::BlockedContentSource::eEval: + aString.AssignLiteral("eval"); + break; + + case nsCSPContext::BlockedContentSource::eSelf: + aString.AssignLiteral("self"); + break; + } +} + /** * Creates a key for use in the ShouldLoad cache. * Looks like: ! @@ -275,6 +298,7 @@ nsCSPContext::permitsInternal(CSPDirective aDir, AsyncReportViolation(aTriggeringElement, (aSendContentLocationInViolationReports ? aContentLocation : nullptr), + BlockedContentSource::eUnknown, /* a BlockedContentSource */ aOriginalURI, /* in case of redirect originalURI is not null */ violatedDirective, p, /* policy index */ @@ -481,12 +505,6 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType, : NS_LITERAL_STRING(STYLE_HASH_VIOLATION_OBSERVER_TOPIC); } - nsCOMPtr selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID)); - if (selfICString) { - selfICString->SetData(nsDependentCString("inline")); - } - nsCOMPtr selfISupports(do_QueryInterface(selfICString)); - // use selfURI as the sourceFile nsAutoCString sourceFile; if (mSelfURI) { @@ -494,7 +512,8 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType, } AsyncReportViolation(aTriggeringElement, - selfISupports, // aBlockedContentSource + nullptr, // aBlockedURI + BlockedContentSource::eInline, // aBloeckedSource mSelfURI, // aOriginalURI aViolatedDirective, // aViolatedDirective aViolatedPolicyIndex, // aViolatedPolicyIndex @@ -595,7 +614,7 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType, * * Note: This macro uses some parameters from its caller's context: * p, mPolicies, this, aSourceFile, aScriptSample, aLineNum, aColumnNum, - * selfISupports + * blockedContentSource * * @param violationType: the VIOLATION_TYPE_* constant (partial symbol) * such as INLINE_SCRIPT @@ -622,8 +641,8 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType, mPolicies[p]->getDirectiveStringAndReportSampleForContentType( \ nsIContentPolicy::TYPE_ ## contentPolicyType, \ violatedDirective, &reportSample); \ - AsyncReportViolation(aTriggeringElement, selfISupports, nullptr, \ - violatedDirective, p, \ + AsyncReportViolation(aTriggeringElement, nullptr, blockedContentSource, \ + nullptr, violatedDirective, p, \ NS_LITERAL_STRING(observerTopic), \ aSourceFile, \ reportSample \ @@ -670,20 +689,17 @@ nsCSPContext::LogViolationDetails(uint16_t aViolationType, for (uint32_t p = 0; p < mPolicies.Length(); p++) { NS_ASSERTION(mPolicies[p], "null pointer in nsTArray"); - nsCOMPtr selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID)); - if (selfICString) { - if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) { - selfICString->SetData(nsDependentCString("eval")); - } else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT || - aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) { - selfICString->SetData(nsDependentCString("inline")); - } else { - // All the other types should have a URL, but just in case, let's use - // 'self' here. - selfICString->SetData(nsDependentCString("self")); - } + BlockedContentSource blockedContentSource = BlockedContentSource::eUnknown; + if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) { + blockedContentSource = BlockedContentSource::eEval; + } else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT || + aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) { + blockedContentSource = BlockedContentSource::eInline; + } else { + // All the other types should have a URL, but just in case, let's use + // 'self' here. + blockedContentSource = BlockedContentSource::eSelf; } - nsCOMPtr selfISupports(do_QueryInterface(selfICString)); switch (aViolationType) { CASE_CHECK_AND_REPORT(EVAL, SCRIPT, NS_LITERAL_STRING(""), @@ -874,16 +890,7 @@ StripURIForReporting(nsIURI* aURI, return; } - // 2) If the origin of uri is not the same as the origin of the protected - // resource, then return the ASCII serialization of uri’s origin. - if (!NS_SecurityCompareURIs(aSelfURI, aURI, false)) { - // cross origin redirects also fall into this category, see: - // http://www.w3.org/TR/CSP/#violation-reports - aURI->GetPrePath(outStrippedURI); - return; - } - - // 3) Return uri, with any fragment component removed. + // Return uri, with any fragment component removed. aURI->GetSpecIgnoringRef(outStrippedURI); } @@ -917,7 +924,8 @@ nsCSPContext::GatherSecurityPolicyViolationEventData( // blocked-uri if (aBlockedURI) { nsAutoCString reportBlockedURI; - StripURIForReporting(aBlockedURI, mSelfURI, reportBlockedURI); + StripURIForReporting(aOriginalURI ? aOriginalURI : aBlockedURI, + mSelfURI, reportBlockedURI); aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(reportBlockedURI); } else { aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(aBlockedString); @@ -1252,7 +1260,8 @@ class CSPReportSenderRunnable final : public Runnable { public: CSPReportSenderRunnable(Element* aTriggeringElement, - nsISupports* aBlockedContentSource, + nsIURI* aBlockedURI, + nsCSPContext::BlockedContentSource aBlockedContentSource, nsIURI* aOriginalURI, uint32_t aViolatedPolicyIndex, bool aReportOnlyFlag, @@ -1265,6 +1274,7 @@ class CSPReportSenderRunnable final : public Runnable nsCSPContext* aCSPContext) : mozilla::Runnable("CSPReportSenderRunnable") , mTriggeringElement(aTriggeringElement) + , mBlockedURI(aBlockedURI) , mBlockedContentSource(aBlockedContentSource) , mOriginalURI(aOriginalURI) , mViolatedPolicyIndex(aViolatedPolicyIndex) @@ -1280,13 +1290,22 @@ class CSPReportSenderRunnable final : public Runnable // the observer subject is an nsISupports: either an nsISupportsCString // from the arg passed in directly, or if that's empty, it's the blocked // source. + if (aObserverSubject.IsEmpty() && mBlockedURI) { + mObserverSubject = aBlockedURI; + return; + } + + nsAutoCString subject; if (aObserverSubject.IsEmpty()) { - mObserverSubject = aBlockedContentSource; + BlockedContentSourceToString(aBlockedContentSource, subject); } else { - nsCOMPtr supportscstr = - do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID); - NS_ASSERTION(supportscstr, "Couldn't allocate nsISupportsCString"); - supportscstr->SetData(NS_ConvertUTF16toUTF8(aObserverSubject)); + CopyUTF16toUTF8(aObserverSubject, subject); + } + + nsCOMPtr supportscstr = + do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID); + if (supportscstr) { + supportscstr->SetData(subject); mObserverSubject = do_QueryInterface(supportscstr); } } @@ -1299,17 +1318,12 @@ class CSPReportSenderRunnable final : public Runnable // 0) prepare violation data mozilla::dom::SecurityPolicyViolationEventInit init; - // mBlockedContentSource could be a URI or a string. - nsCOMPtr blockedURI = do_QueryInterface(mBlockedContentSource); - // if mBlockedContentSource is not a URI, it could be a string - nsCOMPtr blockedICString = do_QueryInterface(mBlockedContentSource); - nsAutoCString blockedDataStr; - if (blockedICString) { - blockedICString->GetData(blockedDataStr); - } + + nsAutoCString blockedContentSource; + BlockedContentSourceToString(mBlockedContentSource, blockedContentSource); rv = mCSPContext->GatherSecurityPolicyViolationEventData( - blockedURI, blockedDataStr, mOriginalURI, + mBlockedURI, blockedContentSource, mOriginalURI, mViolatedDirective, mViolatedPolicyIndex, mSourceFile, mScriptSample, mLineNum, mColumnNum, init); @@ -1317,34 +1331,35 @@ class CSPReportSenderRunnable final : public Runnable // 1) notify observers nsCOMPtr observerService = mozilla::services::GetObserverService(); - NS_ASSERTION(observerService, "needs observer service"); - rv = observerService->NotifyObservers(mObserverSubject, - CSP_VIOLATION_TOPIC, - mViolatedDirective.get()); - NS_ENSURE_SUCCESS(rv, rv); + if (mObserverSubject && observerService) { + rv = observerService->NotifyObservers(mObserverSubject, + CSP_VIOLATION_TOPIC, + mViolatedDirective.get()); + NS_ENSURE_SUCCESS(rv, rv); + } // 2) send reports for the policy that was violated mCSPContext->SendReports(init, mViolatedPolicyIndex); // 3) log to console (one per policy violation) - if (blockedURI) { - blockedURI->GetSpec(blockedDataStr); - if (blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) { + if (mBlockedURI) { + mBlockedURI->GetSpec(blockedContentSource); + if (blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) { bool isData = false; - rv = blockedURI->SchemeIs("data", &isData); + rv = mBlockedURI->SchemeIs("data", &isData); if (NS_SUCCEEDED(rv) && isData && - blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) { - blockedDataStr.Truncate(nsCSPContext::ScriptSampleMaxLength()); - blockedDataStr.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis())); + blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) { + blockedContentSource.Truncate(nsCSPContext::ScriptSampleMaxLength()); + blockedContentSource.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis())); } } } - if (blockedDataStr.Length() > 0) { - nsString blockedDataChar16 = NS_ConvertUTF8toUTF16(blockedDataStr); + if (blockedContentSource.Length() > 0) { + nsString blockedContentSource16 = NS_ConvertUTF8toUTF16(blockedContentSource); const char16_t* params[] = { mViolatedDirective.get(), - blockedDataChar16.get() }; + blockedContentSource16.get() }; mCSPContext->logToConsole(mReportOnlyFlag ? "CSPROViolationWithURI" : "CSPViolationWithURI", params, ArrayLength(params), mSourceFile, mScriptSample, @@ -1359,7 +1374,8 @@ class CSPReportSenderRunnable final : public Runnable private: RefPtr mTriggeringElement; - nsCOMPtr mBlockedContentSource; + nsCOMPtr mBlockedURI; + nsCSPContext::BlockedContentSource mBlockedContentSource; nsCOMPtr mOriginalURI; uint32_t mViolatedPolicyIndex; bool mReportOnlyFlag; @@ -1403,7 +1419,8 @@ class CSPReportSenderRunnable final : public Runnable */ nsresult nsCSPContext::AsyncReportViolation(Element* aTriggeringElement, - nsISupports* aBlockedContentSource, + nsIURI* aBlockedURI, + BlockedContentSource aBlockedContentSource, nsIURI* aOriginalURI, const nsAString& aViolatedDirective, uint32_t aViolatedPolicyIndex, @@ -1417,6 +1434,7 @@ nsCSPContext::AsyncReportViolation(Element* aTriggeringElement, nsCOMPtr task = new CSPReportSenderRunnable(aTriggeringElement, + aBlockedURI, aBlockedContentSource, aOriginalURI, aViolatedPolicyIndex, diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h index b14df7b8c862..cd3676a4d95e 100644 --- a/dom/security/nsCSPContext.h +++ b/dom/security/nsCSPContext.h @@ -107,8 +107,17 @@ class nsCSPContext : public nsIContentSecurityPolicy mozilla::dom::Element* aTriggeringElement, const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit); + enum BlockedContentSource + { + eUnknown, + eInline, + eEval, + eSelf, + }; + nsresult AsyncReportViolation(mozilla::dom::Element* aTriggeringElement, - nsISupports* aBlockedContentSource, + nsIURI* aBlockedURI, + BlockedContentSource aBlockedContentSource, nsIURI* aOriginalURI, const nsAString& aViolatedDirective, uint32_t aViolatedPolicyIndex, diff --git a/dom/security/test/csp/test_blocked_uri_in_reports.html b/dom/security/test/csp/test_blocked_uri_in_reports.html index 7e656509e244..11b1e29a82d8 100644 --- a/dom/security/test/csp/test_blocked_uri_in_reports.html +++ b/dom/security/test/csp/test_blocked_uri_in_reports.html @@ -50,7 +50,7 @@ script.addMessageListener('opening-request-completed', function ml(msg) { var cspReport = reportObj["csp-report"]; // blocked-uri should only be the asciiHost instead of: // http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js - is(cspReport["blocked-uri"], "http://test1.example.com", "Incorrect blocked-uri"); + is(cspReport["blocked-uri"], "http://example.com/tests/dom/security/test/csp/file_path_matching_redirect_server.sjs", "Incorrect blocked-uri"); } catch (e) { ok(false, "Could not query report (exception: " + e + ")"); } diff --git a/dom/security/test/csp/test_report_for_import.html b/dom/security/test/csp/test_report_for_import.html index 452dc5f745d0..7d95acbd3953 100644 --- a/dom/security/test/csp/test_report_for_import.html +++ b/dom/security/test/csp/test_report_for_import.html @@ -57,7 +57,7 @@ function checkResults(reportStr) { "http://mochi.test:8888/tests/dom/security/test/csp/file_report_for_import_server.sjs?report", "Incorrect original-policy"); is(cspReport["blocked-uri"], - "http://example.com", + "http://example.com/tests/dom/security/test/csp/file_report_for_import_server.sjs?stylesheet", "Incorrect blocked-uri"); // we do not always set the following fields diff --git a/dom/security/test/unit/test_csp_reports.js b/dom/security/test/unit/test_csp_reports.js index 0d2e29bc58f4..05e845e9f294 100644 --- a/dom/security/test/unit/test_csp_reports.js +++ b/dom/security/test/unit/test_csp_reports.js @@ -147,7 +147,7 @@ function run_test() { } }); - makeTest(2, {"blocked-uri": "http://blocked.test"}, false, + makeTest(2, {"blocked-uri": "http://blocked.test/foo.js"}, false, function(csp) { // shouldLoad creates and sends out the report here. csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT, @@ -226,7 +226,7 @@ function run_test() { }); // test scheme of ftp: - makeTest(8, {"blocked-uri": "ftp://blocked.test"}, false, + makeTest(8, {"blocked-uri": "ftp://blocked.test/profile.png"}, false, function(csp) { // shouldLoad creates and sends out the report here. csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT, diff --git a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini index d08fe125c549..cb39752b7cf5 100644 --- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini +++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini @@ -1,4 +1,4 @@ [media-src-7_1_2.sub.html] + expected: TIMEOUT [Test that securitypolicyviolation events are fired] - expected: FAIL - + expected: TIMEOUT diff --git a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini index e4b35bae287c..8b32d976d816 100644 --- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini +++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini @@ -1,4 +1,4 @@ [media-src-7_2_2.sub.html] + expected: TIMEOUT [Test that securitypolicyviolation events are fired] - expected: FAIL - + expected: TIMEOUT diff --git a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini deleted file mode 100644 index cd02dea03260..000000000000 --- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[media-src-7_3_2.sub.html] - [Test that securitypolicyviolation events are fired] - expected: FAIL - diff --git a/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini b/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini index 5dfca0e88b38..2d80128a361b 100644 --- a/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini +++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini @@ -1,4 +1,4 @@ [media-src-blocked.sub.html] + expected: TIMEOUT [Test that securitypolicyviolation events are fired] - expected: FAIL - + expected: TIMEOUT diff --git a/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini b/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini index 52b95feb6c74..a8137eb3cb0e 100644 --- a/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini +++ b/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini @@ -1,4 +1,7 @@ [report-original-url.sub.html] expected: TIMEOUT - [Direct block, cross-origin = full URL in report] + [Block after redirect, same-origin = original URL in report] + expected: TIMEOUT + + [Block after redirect, cross-origin = original URL in report] expected: TIMEOUT diff --git a/testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini b/testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini deleted file mode 100644 index 1aab8623c954..000000000000 --- a/testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[report-strips-fragment.html] - expected: TIMEOUT - [Reported document URI does not contain fragments.] - expected: TIMEOUT diff --git a/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini b/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini index c39ada01df6f..c85e80d8ca55 100644 --- a/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini +++ b/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini @@ -1,4 +1,3 @@ [script-src-strict_dynamic_double_policy_honor_whitelist.sub.html] - expected: TIMEOUT [Non-whitelisted script injected via `appendChild` is not allowed with `strict-dynamic` + a nonce+whitelist double policy.] - expected: TIMEOUT + expected: FAIL diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini deleted file mode 100644 index 7cdce71572cf..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini +++ /dev/null @@ -1,5 +0,0 @@ -[inside-dedicated-worker.html] - expected: TIMEOUT - [SecurityPolicyViolation event fired on global.] - expected: TIMEOUT - diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini deleted file mode 100644 index 0fc292a6db6b..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini +++ /dev/null @@ -1,5 +0,0 @@ -[inside-service-worker.https.html] - expected: TIMEOUT - [SecurityPolicyViolation event fired on global.] - expected: TIMEOUT - diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini deleted file mode 100644 index dd86fc219e18..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini +++ /dev/null @@ -1,5 +0,0 @@ -[inside-shared-worker.html] - expected: TIMEOUT - [SecurityPolicyViolation event fired on global.] - expected: TIMEOUT - diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini deleted file mode 100644 index 3e49588f4e24..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[securitypolicyviolation-block-cross-origin-image-from-script.sub.html] - [Non-redirected cross-origin URLs are not stripped.] - expected: FAIL - diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini deleted file mode 100644 index 0f3438585ff1..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[securitypolicyviolation-block-cross-origin-image.sub.html] - [Non-redirected cross-origin URLs are not stripped.] - expected: FAIL - diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini deleted file mode 100644 index b06250790692..000000000000 --- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini +++ /dev/null @@ -1,4 +0,0 @@ -[securitypolicyviolation-block-image-from-script.sub.html] - [Non-redirected cross-origin URLs are not stripped.] - expected: FAIL - diff --git a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html index 27611273babc..c63206db4643 100644 --- a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html +++ b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html @@ -4,10 +4,10 @@ - - - - - -
- - - - diff --git a/dom/xbl/crashtests/415301-1.xul b/dom/xbl/crashtests/415301-1.xul deleted file mode 100644 index cee274fcd3af..000000000000 --- a/dom/xbl/crashtests/415301-1.xul +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dom/xbl/crashtests/463511-1.xhtml b/dom/xbl/crashtests/463511-1.xhtml deleted file mode 100644 index a9fec3b5099b..000000000000 --- a/dom/xbl/crashtests/463511-1.xhtml +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/dom/xbl/crashtests/crashtests.list b/dom/xbl/crashtests/crashtests.list index bc53bd2811d0..434d7300c044 100644 --- a/dom/xbl/crashtests/crashtests.list +++ b/dom/xbl/crashtests/crashtests.list @@ -14,19 +14,16 @@ load 378521-1.xhtml load 382376-1.xhtml load 382376-2.xhtml load 397596-1.xhtml -load 404125-1.xhtml load 406900-1.xul load 406904-1.xhtml load 406904-2.xhtml load 415192-1.xul -load 415301-1.xul load 418133-1.xhtml load 420233-1.xhtml load 421997-1.xhtml load 432813-1.xhtml load 454820-1.html load 460665-1.xhtml -load 463511-1.xhtml load 464863-1.xhtml load 472260-1.xhtml load 477878-1.html diff --git a/layout/base/crashtests/354771-1.xul b/layout/base/crashtests/354771-1.xul deleted file mode 100644 index 0ff2ba8e7910..000000000000 --- a/layout/base/crashtests/354771-1.xul +++ /dev/null @@ -1,28 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/layout/base/crashtests/373919.xhtml b/layout/base/crashtests/373919.xhtml deleted file mode 100644 index 42b194b9e530..000000000000 --- a/layout/base/crashtests/373919.xhtml +++ /dev/null @@ -1,29 +0,0 @@ - - -