mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-20 15:27:32 +09:00
Issue #2728 - Remove obsolete CSP referrer policy.
This has been superseded by the dedicated Referrer-policy header. Resolves #2728
This commit is contained in:
Moonchild
roytam1
parent
d7f01911b8
commit
0331e633bd
16 changed files with 14 additions and 606 deletions
|
|
@ -1,55 +0,0 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<title>Subframe test for bug 965727</title>
|
||||
|
||||
<script type="text/javascript">
|
||||
// we can get the ID out of the querystring.
|
||||
var args = document.location.search.substring(1).split('&');
|
||||
var id = "unknown";
|
||||
for (var i=0; i < args.length; i++) {
|
||||
var arg = unescape(args[i]);
|
||||
if (arg.indexOf('=') > 0 && arg.indexOf('id') == 0) {
|
||||
id = arg.split('=')[1].trim();
|
||||
}
|
||||
}
|
||||
|
||||
var results = {
|
||||
'id': id,
|
||||
'referrer': document.location.href,
|
||||
'results': {
|
||||
'sameorigin': false,
|
||||
'crossorigin': false,
|
||||
'downgrade': false
|
||||
}
|
||||
};
|
||||
|
||||
// this is called back by each script load.
|
||||
var postResult = function(loadType, referrerLevel, referrer) {
|
||||
results.results[loadType] = referrerLevel;
|
||||
|
||||
// and then check if all three have loaded.
|
||||
for (var id in results.results) {
|
||||
if (!results.results[id]) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
//finished if we don't return early
|
||||
window.parent.postMessage(JSON.stringify(results), "*");
|
||||
console.log(JSON.stringify(results));
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
Testing ...
|
||||
|
||||
<script src="https://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=sameorigin&"
|
||||
onerror="postResult('sameorigin', 'error');"></script>
|
||||
<script src="https://test2.example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=crossorigin&"
|
||||
onerror="postResult('crossorigin', 'error');"></script>
|
||||
<script src="http://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=downgrade&"
|
||||
onerror="postResult('downgrade', 'error');"></script>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
// special *.sjs specifically customized for the needs of
|
||||
// Bug 1139297 and Bug 663570
|
||||
|
||||
const PRE_HEAD =
|
||||
"<!DOCTYPE HTML>" +
|
||||
"<html>" +
|
||||
"<head>";
|
||||
|
||||
const POST_HEAD =
|
||||
"<meta charset='utf-8'>" +
|
||||
"<title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>" +
|
||||
"</head>" +
|
||||
"<body>" +
|
||||
"<img id='testimage' src='http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs?img'></img>" +
|
||||
"</body>" +
|
||||
"</html>";
|
||||
|
||||
const PRE_CSP = "upgrade-insecure-requests; default-src https:; ";
|
||||
const CSP_REFERRER_ORIGIN = "referrer origin";
|
||||
const CSP_REFEFFER_NO_REFERRER = "referrer no-referrer";
|
||||
|
||||
function handleRequest(request, response)
|
||||
{
|
||||
// avoid confusing cache behaviors
|
||||
response.setHeader("Cache-Control", "no-cache", false);
|
||||
var queryString = request.queryString;
|
||||
|
||||
if (queryString === "test1") {
|
||||
response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFERRER_ORIGIN, false);
|
||||
response.write(PRE_HEAD + POST_HEAD);
|
||||
return;
|
||||
}
|
||||
|
||||
if (queryString === "test2") {
|
||||
response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFEFFER_NO_REFERRER, false);
|
||||
response.write(PRE_HEAD + POST_HEAD);
|
||||
return;
|
||||
}
|
||||
|
||||
if (queryString === "test3") {
|
||||
var metacsp = "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFERRER_ORIGIN + "\" >";
|
||||
response.write(PRE_HEAD + metacsp + POST_HEAD);
|
||||
return;
|
||||
}
|
||||
|
||||
if (queryString === "test4") {
|
||||
var metacsp = "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFEFFER_NO_REFERRER + "\" >";
|
||||
response.write(PRE_HEAD + metacsp + POST_HEAD);
|
||||
return;
|
||||
}
|
||||
|
||||
// we should never get here, but just in case return
|
||||
// something unexpected
|
||||
response.write("do'h");
|
||||
}
|
||||
|
|
@ -1,56 +0,0 @@
|
|||
// Custom *.sjs file specifically for the needs of Bug:
|
||||
// Bug 1139297 - Implement CSP upgrade-insecure-requests directive
|
||||
|
||||
// small red image
|
||||
const IMG_BYTES = atob(
|
||||
"iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
|
||||
"P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
|
||||
|
||||
function handleRequest(request, response)
|
||||
{
|
||||
// avoid confusing cache behaviors
|
||||
response.setHeader("Cache-Control", "no-cache", false);
|
||||
var queryString = request.queryString;
|
||||
|
||||
// (1) lets process the queryresult request async and
|
||||
// wait till we have received the image request.
|
||||
if (queryString == "queryresult") {
|
||||
response.processAsync();
|
||||
setObjectState("queryResult", response);
|
||||
return;
|
||||
}
|
||||
|
||||
// (2) Handle the image request and return the referrer
|
||||
// result back to the stored queryresult request.
|
||||
if (request.queryString == "img") {
|
||||
response.setHeader("Content-Type", "image/png");
|
||||
response.write(IMG_BYTES);
|
||||
|
||||
let referrer = "";
|
||||
try {
|
||||
referrer = request.getHeader("referer");
|
||||
} catch (e) {
|
||||
referrer = "";
|
||||
}
|
||||
// make sure the received image request was upgraded to https,
|
||||
// otherwise we return not only the referrer but also indicate
|
||||
// that the request was not upgraded to https. Note, that
|
||||
// all upgrades happen in the browser before any non-secure
|
||||
// request hits the wire.
|
||||
referrer += (request.scheme == "https") ?
|
||||
"" : " but request is not https";
|
||||
|
||||
getObjectState("queryResult", function(queryResponse) {
|
||||
if (!queryResponse) {
|
||||
return;
|
||||
}
|
||||
queryResponse.write(referrer);
|
||||
queryResponse.finish();
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
// we should not get here ever, but just in case return
|
||||
// something unexpected.
|
||||
response.write("doh!");
|
||||
}
|
||||
|
|
@ -125,7 +125,6 @@ support-files =
|
|||
file_multi_policy_injection_bypass_2.html^headers^
|
||||
file_null_baseuri.html
|
||||
file_form-action.html
|
||||
file_referrerdirective.html
|
||||
referrerdirective.sjs
|
||||
file_upgrade_insecure.html
|
||||
file_upgrade_insecure_meta.html
|
||||
|
|
@ -133,8 +132,6 @@ support-files =
|
|||
file_upgrade_insecure_wsh.py
|
||||
file_upgrade_insecure_reporting.html
|
||||
file_upgrade_insecure_reporting_server.sjs
|
||||
file_upgrade_insecure_referrer.sjs
|
||||
file_upgrade_insecure_referrer_server.sjs
|
||||
file_upgrade_insecure_cors.html
|
||||
file_upgrade_insecure_cors_server.sjs
|
||||
file_report_for_import.css
|
||||
|
|
@ -266,15 +263,12 @@ skip-if = toolkit == 'android' # Times out, not sure why (bug 1008445)
|
|||
[test_leading_wildcard.html]
|
||||
[test_multi_policy_injection_bypass.html]
|
||||
[test_null_baseuri.html]
|
||||
[test_referrerdirective.html]
|
||||
[test_dual_header.html]
|
||||
[test_upgrade_insecure.html]
|
||||
# no ssl support as well as websocket tests do not work (see test_websocket.html)
|
||||
skip-if = toolkit == 'android' || (os != 'linux' && !debug) # Bug 1316305, Bug 1183300
|
||||
[test_upgrade_insecure_reporting.html]
|
||||
skip-if = toolkit == 'android'
|
||||
[test_upgrade_insecure_referrer.html]
|
||||
skip-if = toolkit == 'android'
|
||||
[test_upgrade_insecure_cors.html]
|
||||
skip-if = toolkit == 'android'
|
||||
[test_report_for_import.html]
|
||||
|
|
|
|||
|
|
@ -1,143 +0,0 @@
|
|||
<!--
|
||||
Any copyright is dedicated to the Public Domain.
|
||||
http://creativecommons.org/publicdomain/zero/1.0/
|
||||
-->
|
||||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<!--
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=965727
|
||||
-->
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Content Security Policy referrer Directive (Bug 965727)</title>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<div id="content" style="display: none">
|
||||
|
||||
</div>
|
||||
<pre id="test">
|
||||
<script class="testbody" type="application/javascript">
|
||||
/*
|
||||
* This tests various referrer policies and the referrer-sending behavior when
|
||||
* requesting scripts in different ways:
|
||||
* - cross-origin (https://example.com -> https://test2.example.com)
|
||||
* - same-origin (https://example.com -> https://example.com)
|
||||
* - downgrade (https://example.com -> http://example.com)
|
||||
*
|
||||
* Each test creates an iframe that loads scripts for each of the checks. If
|
||||
* the scripts are blocked, the test fails (they should run). When loaded,
|
||||
* each script updates a results object in the test page, and then when the
|
||||
* test page has finished loading all the scripts, it postMessages back to this
|
||||
* page. Once all tests are done, the results are checked.
|
||||
*/
|
||||
|
||||
var testData = {
|
||||
'default': { 'csp': "script-src * 'unsafe-inline'; referrer default",
|
||||
'expected': { 'sameorigin': 'full',
|
||||
'crossorigin': 'full',
|
||||
'downgrade': 'none' }},
|
||||
|
||||
'origin': { 'csp': "script-src * 'unsafe-inline'; referrer origin",
|
||||
'expected': { 'sameorigin': 'origin',
|
||||
'crossorigin': 'origin',
|
||||
'downgrade': 'origin' }},
|
||||
|
||||
'origin-when-cross-origin': { 'csp': "script-src * 'unsafe-inline'; referrer origin-when-cross-origin",
|
||||
'expected': { 'sameorigin': 'full',
|
||||
'crossorigin': 'origin',
|
||||
'downgrade': 'origin' }},
|
||||
|
||||
'unsafe-url': { 'csp': "script-src * 'unsafe-inline'; referrer unsafe-url",
|
||||
'expected': { 'sameorigin': 'full',
|
||||
'crossorigin': 'full',
|
||||
'downgrade': 'full' }},
|
||||
|
||||
'none': { 'csp': "script-src * 'unsafe-inline'; referrer no-referrer",
|
||||
'expected': { 'sameorigin': 'none',
|
||||
'crossorigin': 'none',
|
||||
'downgrade': 'none' }},
|
||||
|
||||
// referrer delivered through CSPRO should be ignored
|
||||
'ignore-cspro': { 'cspro': "script-src * 'unsafe-inline'; referrer origin",
|
||||
'expected': { 'sameorigin': 'full',
|
||||
'crossorigin': 'full',
|
||||
'downgrade': 'none' }},
|
||||
|
||||
// referrer delivered through CSPRO should be ignored
|
||||
'ignore-cspro2': { 'csp' : "script-src * 'unsafe-inline'; referrer no-referrer",
|
||||
'cspro': "script-src * 'unsafe-inline'; referrer origin",
|
||||
'expected': { 'sameorigin': 'none',
|
||||
'crossorigin': 'none',
|
||||
'downgrade': 'none' }},
|
||||
};
|
||||
|
||||
var referrerDirectiveTests = {
|
||||
// called via postMessage when one of the iframes is done running.
|
||||
onIframeComplete: function(event) {
|
||||
try {
|
||||
var results = JSON.parse(event.data);
|
||||
ok(results.hasOwnProperty('id'), "'id' property required in posted message " + event.data);
|
||||
|
||||
ok(testData.hasOwnProperty(results['id']), "Test " + results['id'] + " must be expected.");
|
||||
|
||||
// check all the various load types' referrers.
|
||||
var expected = testData[results['id']].expected;
|
||||
for (var t in expected) {
|
||||
is(results.results[t], expected[t],
|
||||
" referrer must match expected for " + t + " in " + results['id']);
|
||||
}
|
||||
testData[results['id']]['complete'] = true;
|
||||
|
||||
} catch(e) {
|
||||
// fail -- should always be JSON
|
||||
ok(false, "failed to parse posted message + " + event.data);
|
||||
// have to end as well since not all messages were valid.
|
||||
SimpleTest.finish();
|
||||
}
|
||||
|
||||
referrerDirectiveTests.checkForCompletion();
|
||||
},
|
||||
|
||||
// checks to see if all the parallel tests are done and validates results.
|
||||
checkForCompletion: function() {
|
||||
for (var id in testData) {
|
||||
if (!testData[id].hasOwnProperty('complete')) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
SimpleTest.finish();
|
||||
}
|
||||
};
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
// have to disable mixed content blocking to test https->http referrers.
|
||||
SpecialPowers.pushPrefEnv({
|
||||
'set': [['security.mixed_content.block_active_content', false],
|
||||
['security.mixed_content.block_display_content', false],
|
||||
]
|
||||
},
|
||||
function() {
|
||||
// each of the iframes we create will call us back when its contents are loaded.
|
||||
window.addEventListener("message", referrerDirectiveTests.onIframeComplete.bind(window), false);
|
||||
|
||||
// one iframe created for each test case
|
||||
for (var id in testData) {
|
||||
var elt = document.createElement("iframe");
|
||||
var src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?id=" + id;
|
||||
if (testData[id]['csp']) {
|
||||
src += "&csp=" + escape(testData[id]['csp']);
|
||||
}
|
||||
if (testData[id]['cspro']) {
|
||||
src += "&cspro=" + escape(testData[id]['cspro']);
|
||||
}
|
||||
src += "&file=tests/dom/security/test/csp/file_referrerdirective.html";
|
||||
elt.src = src;
|
||||
document.getElementById("content").appendChild(elt);
|
||||
}
|
||||
});
|
||||
</script>
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,85 +0,0 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>
|
||||
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<iframe style="width:100%;" id="testframe"></iframe>
|
||||
|
||||
<script class="testbody" type="text/javascript">
|
||||
|
||||
/* Description of the test:
|
||||
* We load a page that makes use of the CSP referrer directive as well
|
||||
* as upgrade-insecure-requests. The page loads an image over http.
|
||||
* The test makes sure the request gets upgraded to https and the
|
||||
* correct referrer gets sent.
|
||||
*/
|
||||
|
||||
var tests = [
|
||||
{
|
||||
query: "test1",
|
||||
description: "upgrade insecure request with 'referrer = origin' (CSP in header)",
|
||||
result: "http://example.com/"
|
||||
},
|
||||
{
|
||||
query: "test2",
|
||||
description: "upgrade insecure request with 'referrer = no-referrer' (CSP in header)",
|
||||
result: ""
|
||||
},
|
||||
{
|
||||
query: "test3",
|
||||
description: "upgrade insecure request with 'referrer = origin' (Meta CSP)",
|
||||
result: "http://example.com/"
|
||||
},
|
||||
{
|
||||
query: "test4",
|
||||
description: "upgrade insecure request with 'referrer = no-referrer' (Meta CSP)",
|
||||
result: ""
|
||||
}
|
||||
];
|
||||
|
||||
var counter = 0;
|
||||
var curTest;
|
||||
|
||||
function loadTestPage() {
|
||||
curTest = tests[counter++];
|
||||
var src = "http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer.sjs?";
|
||||
// append the query
|
||||
src += curTest.query;
|
||||
document.getElementById("testframe").src = src;
|
||||
}
|
||||
|
||||
function runNextTest() {
|
||||
// sends a request to the server which is processed async and returns
|
||||
// once the server received the expected image request
|
||||
var myXHR = new XMLHttpRequest();
|
||||
myXHR.open("GET", "file_upgrade_insecure_referrer_server.sjs?queryresult");
|
||||
myXHR.onload = function(e) {
|
||||
is(myXHR.responseText, curTest.result, curTest.description);
|
||||
if (counter == tests.length) {
|
||||
SimpleTest.finish();
|
||||
return;
|
||||
}
|
||||
// move on to the next test by setting off another query request.
|
||||
runNextTest();
|
||||
}
|
||||
myXHR.onerror = function(e) {
|
||||
ok(false, "could not query results from server (" + e.message + ")");
|
||||
SimpleTest.finish();
|
||||
}
|
||||
myXHR.send();
|
||||
|
||||
// give it some time and load the testpage
|
||||
SimpleTest.executeSoon(loadTestPage);
|
||||
}
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
runNextTest();
|
||||
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Add table
Add a link
Reference in a new issue