277949ed10
Bug 1476592 - Remove the cache from nsCSPContext - part 1, r=ckerschb
2018-08-01 06:35:21 +02:00
fc1f4bb4ae
Bug 1476820 - Convert some VarCache prefs in dom/security/ to use StaticPrefs. r=ckerschb
...
Specifically:
- "security.csp.enable"
- "security.csp.experimentalEnabled"
- "security.csp.enableStrictDynamic"
- "security.csp.reporting.script-sample.max-length"
- "security.csp.enable_violation_events"
MozReview-Commit-ID: G1ie4ut9QaK
--HG--
extra : rebase_source : d6b5a0e79eb7046a13a8b4fe957c82c11831c86c
2018-07-19 10:43:29 +10:00
d3cf48d4ba
Bug 1332422 - CSP should not use 'aExtra' to indicate redirects within ContentPolicy, r=ckerschb
...
Instead, let's pass a nsIURI object to indicate when we have to check a
redirect CSP loading.
2018-07-19 13:25:50 +02:00
595fee0d91
Bug 1476280 - SecurityPolicyViolationEvent.blockedURI should contain the original URL in case of redirects, r=ckerschb
2018-07-18 16:49:18 +02:00
14262bdc7c
Bug 1418241 - CSP violation: blockedURI inline/eval, r=ckerschb
2018-07-17 11:13:12 +02:00
ceea0172b0
Bug 1473587 - CSP Violation events should have the correct sample for inline contexts, r=jorendorff, r=ckerschb
2018-07-16 17:58:04 +02:00
8fe4d55300
Bug 1472927 - Fix CSP violation events in workers, r=asuth, r=ckerschb
2018-07-10 18:53:03 +02:00
5fff1762ad
Bug 1418236 - Correct EventTarget for CSP violation events, r=ckerschb
2018-07-10 17:40:21 +02:00
14d462eeb3
Bug 1418246 - Return valid columnNumber value in CSP violation events, r=ckerschb
2018-07-05 08:21:04 +02:00
27171aed4f
Bug 1236222 - CSP: Blocked URI should be empty for inline violations. r=ckerschb
...
MozReview-Commit-ID: 6bMAVJl9RTG
--HG--
extra : rebase_source : e2cceb777ac659f7fd1a84f6d8408dc7e7179a35
2018-03-08 16:23:03 -08:00
b42210d9c7
Backed out changeset 7d62c45d5973 (bug 1236222) for X xpcshell failures in :toolkit/components/extensions/test/xpcshell/test_ext_contentscript_triggeringPrincipal.js on a CLOSED TREE
2018-03-12 21:35:57 +02:00
e9feb72a33
Bug 1236222 - CSP: Blocked URI should be empty for inline violations. r=ckerschb
...
MozReview-Commit-ID: 6bMAVJl9RTG
--HG--
extra : rebase_source : 7cbfe8c7b99671bc181eaa7c16aae9af657bbda7
2018-03-08 16:23:03 -08:00
63739feac3
Bug 1037335 - Add a pref to enable only within Nightly and Early Beta. r=ckerschb,smaug
...
MozReview-Commit-ID: Bi82dHm53qX
--HG--
extra : rebase_source : 61a7c517afb2759d672a1c486213a73ef505a324
extra : amend_source : 572a2c8613fe36ae1ebd613a361bb23acc019912
2017-11-29 16:55:00 +02:00
8dd7eb1b95
Bug 1037335 - Implement security policy violation event. r=ckerschb,smaug
...
MozReview-Commit-ID: 4BYThUXduI4
--HG--
extra : rebase_source : 5d4a34c5e6bb7fd3774fafb1de72e761bce4591f
2017-11-29 16:53:00 +02:00
326ce05075
Bug 1415352: Part 3a - Add preference to increase max length of CSP report source sample. r=ckerschb
...
This is necessary for tests which need to verify that reports are being sent
for the correct inline sources, where the current sample size is not enough to
completely distinguish them.
MozReview-Commit-ID: 2k2vAhJhIsi
--HG--
extra : rebase_source : 268a53d1450be6666081bf5093aa170352b398e1
2017-11-06 14:01:32 -08:00
c86dc10505
Bug 1380227 - Avoid many UTF16toUTF8 and UTF8toUTF16 conversions in nsStringBundle. r=emk.
...
Most of the names passed to nsIStringBundle::{Get,Format}StringFromUTF8Name
have one of the two following forms:
- a 16-bit C string literal, which is then converted to an 8-bit string in
order for the lookup to occur;
- an 8-bit C string literal converted to a 16-bit string, which is then
converted back to an 8-bit string in order for the lookup to occur.
This patch introduces and uses alternative methods that can take an 8-bit C
string literal, which requires changing some signatures in other methods and
functions. It replaces all C++ uses of the old methods.
The patch also changes the existing {Get,Format}StringFromName() methods so
they take an AUTF8String argument for the name instead of a wstring, because
that's nicer for JS code.
Even though there is a method for C++ code and a different one for JS code,
|binaryname| is used so that the existing method names can be used for the
common case in both languages.
The change reduces the number of NS_ConvertUTF8toUTF16 and
NS_ConvertUTF16toUTF8 conversions while running Speedometer v2 from ~270,000 to
~160,000. (Most of these conversions involved the string
"deprecatedReferrerDirective" in nsCSPParser.cpp.)
--HG--
extra : rebase_source : 3bee57a501035f76a81230d95186f8c3f460ff8e
2017-07-12 15:13:37 +10:00
afaba58d52
Bug 1339004 - Do DocGroup labeling in dom/security. r=ckerschb,smaug
...
MozReview-Commit-ID: 3QoH8P4J85I
--HG--
extra : rebase_source : 6f62454001fc02380f8aea99a56eff38de0e9fb6
2017-03-29 10:20:32 +08:00
115286c614
Backed out changeset 9c1069e2a42e (bug 1236222) for failing xpcshell test test_csp_reports.js. r=backout
2016-11-09 11:31:38 +01:00
134e80abde
Bug 1236222 - CSP: Blocked URI should be empty for inline violations. r=ckerschb
2016-11-07 19:22:53 +05:30
c267f70f91
Bug 1299483 - CSP: Implement 'strict-dynamic', enforcement changes. r=dveditz,freddyb
2016-11-08 12:55:23 +01:00
bf87c6c564
Bug 1252829 - CSP Telemetry. r=ckerschb, p=bsmedberg
...
MozReview-Commit-ID: CiNAxh2ZrHB
--HG--
extra : transplant_source : %B8%00%E0%83%1B%29%BDI%DE%09%CDPN%AE%7B9Tk%8B%99
2016-03-02 13:00:09 +01:00
50588ca7c1
Bug 1188028 - Queue up CSP console messages till windowID is available (r=sicking)
2015-11-11 06:23:57 -08:00
a876eba5c9
Bug 1188028 - Use channel->ascynOpen2 in dom/security/nsCSPContext.cpp (r=sicking)
2015-07-27 11:57:56 -07:00
8001d76219
Bug 1026520 - CSP: Inline report sending into allows - csp changes (r=dveditz)
2015-09-17 22:34:16 -07:00
7d1e52f2ff
Bug 905127 - Part 1 - Make some functions from nsNetUtil not inline. r=jduell
2015-07-07 04:17:00 +02:00
9e8f4b219e
Bug 1152551, part 2 - Fix mode lines in dom/. r=jst
2015-05-03 15:32:37 -04:00
972a6213f9
Bug 1147996 - Enable interception of CSP reports through service workers; r=nsm
...
Currently when sending a CSP report, HttpBaseChannel::ShouldIntercept tries to
get access to the nsINetworkInterceptController interface through the channel's
notification callbacks, but in this case the notification callback is the
CSPReportRedirectSink object (thanks to nsCORSListenerProxy::Init).
This patch extends CSPReportRedirectSink to make it aware of
nsINetworkInterceptController, and have it route the request for
nsINetworkInterceptController correctly to the docshell without the need to
mess with the notification callbacks.
This will be tested in bug 1147699.
2015-03-28 16:28:40 -04:00
e6f385fb3d
Bug 1148527 - Indentation fix after bug 1145631, r=ehsan
2015-03-27 18:52:19 +00:00
883849ee32
Bug 1145631 - Part 1: Replace MOZ_OVERRIDE and MOZ_FINAL with override and final in the tree; r=froydnj
...
This patch was automatically generated using the following script:
function convert() {
echo "Converting $1 to $2..."
find . \
! -wholename "*/.git*" \
! -wholename "obj-ff-dbg*" \
-type f \
\( -iname "*.cpp" \
-o -iname "*.h" \
-o -iname "*.c" \
-o -iname "*.cc" \
-o -iname "*.idl" \
-o -iname "*.ipdl" \
-o -iname "*.ipdlh" \
-o -iname "*.mm" \) | \
xargs -n 1 sed -i -e "s/\b$1\b/$2/g"
}
convert MOZ_OVERRIDE override
convert MOZ_FINAL final
2015-03-21 12:28:04 -04:00
5dc1b5b39c
Bug 999656 - Fix mappings between content type and CSP directives and refactor permits functions in CSP. r=ckerschb
2014-12-10 13:54:00 +01:00
ab97bec4cb
Bug 1089912: Part 1, move csp into dom/security (r=sstamm,jst)
...
--HG--
rename : dom/base/nsIContentSecurityPolicy.idl => dom/interfaces/security/nsIContentSecurityPolicy.idl
rename : dom/base/nsCSPContext.cpp => dom/security/nsCSPContext.cpp
rename : dom/base/nsCSPContext.h => dom/security/nsCSPContext.h
rename : dom/base/nsCSPParser.cpp => dom/security/nsCSPParser.cpp
rename : dom/base/nsCSPParser.h => dom/security/nsCSPParser.h
rename : dom/base/nsCSPService.cpp => dom/security/nsCSPService.cpp
rename : dom/base/nsCSPService.h => dom/security/nsCSPService.h
rename : dom/base/nsCSPUtils.cpp => dom/security/nsCSPUtils.cpp
rename : dom/base/nsCSPUtils.h => dom/security/nsCSPUtils.h
2014-10-27 16:58:20 -07:00
Andrea Marchesini
Nicholas Nethercote
Jonathan Kingston
Margareta Eliza Balazs
Chung-Sheng Fu
Kris Maglione
Thomas Nguyen
Sebastian Hengst
Tanuja Sawant
Christoph Kerschbaumer
Franziskus Kiefer
Christoph Kerschbaumer
Emanuel Hoogeveen
Andrew McCreight
Ehsan Akhgari
Sid Stamm