Bug 576200. CSP breaks spec, defaults to allow *. r=bsterne@mozilla.com, dveditz@mozilla.com

content/base/src/CSPUtils.jsm

@@ -272,8 +272,11 @@ CSPRep.fromString = function(aStr, self) {
 
   } // end directive: loop
 
-  aCSPR.makeExplicit();
+  // if makeExplicit fails for any reason, default to allow 'none'.  This
-  return aCSPR;
+  // includes the case where "allow" is not present.
+  if (aCSPR.makeExplicit())
+    return aCSPR;
+  return CSPRep.fromString("allow 'none'", self);
 };
 
 CSPRep.prototype = {
@@ -409,6 +412,7 @@ CSPRep.prototype = {
     var SD = CSPRep.SRC_DIRECTIVES;
     var allowDir = this._directives[SD.ALLOW];
     if (!allowDir) {
+      CSPWarning("'allow' directive required but not present.  Reverting to \"allow 'none'\"");
       return false;
     }