From d43805d4f63a77636e3b7cdd22c5cf848f9af480 Mon Sep 17 00:00:00 2001 From: Christoph Kerschbaumer Date: Thu, 7 Sep 2017 09:11:38 +0200 Subject: [PATCH] Bug 1396320: Fix CSP sandbox regression for allow-scripts. r=dveditz --- dom/base/nsDocument.cpp | 5 +-- dom/security/test/csp/file_sandbox_13.html | 25 +++++++++++++++ .../test/csp/file_sandbox_allow_scripts.html | 12 +++++++ .../file_sandbox_allow_scripts.html^headers^ | 1 + dom/security/test/csp/mochitest.ini | 5 +++ dom/security/test/csp/test_sandbox.html | 2 +- .../test/csp/test_sandbox_allow_scripts.html | 31 +++++++++++++++++++ 7 files changed, 78 insertions(+), 3 deletions(-) create mode 100644 dom/security/test/csp/file_sandbox_13.html create mode 100644 dom/security/test/csp/file_sandbox_allow_scripts.html create mode 100644 dom/security/test/csp/file_sandbox_allow_scripts.html^headers^ create mode 100644 dom/security/test/csp/test_sandbox_allow_scripts.html diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp index da59504dffbe..efebae247706 100644 --- a/dom/base/nsDocument.cpp +++ b/dom/base/nsDocument.cpp @@ -3016,13 +3016,14 @@ nsDocument::InitCSP(nsIChannel* aChannel) rv = csp->GetCSPSandboxFlags(&cspSandboxFlags); NS_ENSURE_SUCCESS(rv, rv); - mSandboxFlags |= cspSandboxFlags; - // Probably the iframe sandbox attribute already caused the creation of a // new NullPrincipal. Only create a new NullPrincipal if CSP requires so // and no one has been created yet. bool needNewNullPrincipal = (cspSandboxFlags & SANDBOXED_ORIGIN) && !(mSandboxFlags & SANDBOXED_ORIGIN); + + mSandboxFlags |= cspSandboxFlags; + if (needNewNullPrincipal) { principal = NullPrincipal::CreateWithInheritedAttributes(principal); principal->SetCsp(csp); diff --git a/dom/security/test/csp/file_sandbox_13.html b/dom/security/test/csp/file_sandbox_13.html new file mode 100644 index 000000000000..e4672ed0582d --- /dev/null +++ b/dom/security/test/csp/file_sandbox_13.html @@ -0,0 +1,25 @@ + + + + + + + I am sandboxed but with only inline "allow-scripts" + + + + + + + + + + diff --git a/dom/security/test/csp/file_sandbox_allow_scripts.html b/dom/security/test/csp/file_sandbox_allow_scripts.html new file mode 100644 index 000000000000..faab9f0fc684 --- /dev/null +++ b/dom/security/test/csp/file_sandbox_allow_scripts.html @@ -0,0 +1,12 @@ + + + + + Bug 1396320: Fix CSP sandbox regression for allow-scripts + + + + + diff --git a/dom/security/test/csp/file_sandbox_allow_scripts.html^headers^ b/dom/security/test/csp/file_sandbox_allow_scripts.html^headers^ new file mode 100644 index 000000000000..4705ce9dedee --- /dev/null +++ b/dom/security/test/csp/file_sandbox_allow_scripts.html^headers^ @@ -0,0 +1 @@ +Content-Security-Policy: sandbox allow-scripts; diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini index 6b22199f643a..2f33dd33c0bf 100644 --- a/dom/security/test/csp/mochitest.ini +++ b/dom/security/test/csp/mochitest.ini @@ -182,6 +182,7 @@ support-files = file_sandbox_10.html file_sandbox_11.html file_sandbox_12.html + file_sandbox_13.html file_require_sri_meta.sjs file_require_sri_meta.js file_sendbeacon.html @@ -323,3 +324,7 @@ skip-if = toolkit == 'android' support-files = file_uir_top_nav.html file_uir_top_nav_dummy.html +[test_sandbox_allow_scripts.html] +support-files = + file_sandbox_allow_scripts.html + file_sandbox_allow_scripts.html^headers^ diff --git a/dom/security/test/csp/test_sandbox.html b/dom/security/test/csp/test_sandbox.html index b36043a04549..30273ab654d4 100644 --- a/dom/security/test/csp/test_sandbox.html +++ b/dom/security/test/csp/test_sandbox.html @@ -111,7 +111,7 @@ var testCases = [ // * using sandbox flag 'allow-scripts' in CSP and not as iframe attribute // * not using allow-same-origin in CSP (so a new NullPrincipal is created). csp: "default-src 'none'; script-src 'unsafe-inline'; sandbox allow-scripts", - file: "file_sandbox_5.html", + file: "file_sandbox_13.html", results: { img13_bad: -1, img13a_bad: -1, script13_bad: -1, script13a_bad: -1 }, nrOKmessages: 2 // sends 2 ok message }, diff --git a/dom/security/test/csp/test_sandbox_allow_scripts.html b/dom/security/test/csp/test_sandbox_allow_scripts.html new file mode 100644 index 000000000000..10acaae4361c --- /dev/null +++ b/dom/security/test/csp/test_sandbox_allow_scripts.html @@ -0,0 +1,31 @@ + + + + Bug 1396320: Fix CSP sandbox regression for allow-scripts + + + + + + + +