wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-26 09:07:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2402 - ServiceWorker should not inherit CSP from registration principal. https://bugzilla.mozilla.org/show_bug.cgi?id=1337543

Browse source
This commit is contained in:
Brian Smith 2024-01-04 23:57:26 -06:00 • committed by roytam1
commit 1703d936af
1 changed files with 10 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
dom/workers/ServiceWorkerPrivate.cpp
View file

@ -1760,23 +1760,22 @@ ServiceWorkerPrivate::SpawnWorkerIfNeeded(WakeUpReason aWhy,
info.mStorageAllowed = access > nsContentUtils::StorageAccess::ePrivateBrowsing; info.mStorageAllowed = access > nsContentUtils::StorageAccess::ePrivateBrowsing;
info.mOriginAttributes = mInfo->GetOriginAttributes(); info.mOriginAttributes = mInfo->GetOriginAttributes();
// The ServiceWorkerRegistration principal should never have any CSP
// set. The CSP from the page that registered the SW should not be
// inherited. Verify this is the case in non-release builds
#if defined(DEBUG)
nsCOMPtr<nsIContentSecurityPolicy> csp; nsCOMPtr<nsIContentSecurityPolicy> csp;
rv = info.mPrincipal->GetCsp(getter_AddRefs(csp)); rv = info.mPrincipal->GetCsp(getter_AddRefs(csp));
if (NS_WARN_IF(NS_FAILED(rv))) { if (NS_WARN_IF(NS_FAILED(rv))) {
return rv; return rv;
} }
MOZ_DIAGNOSTIC_ASSERT(!csp);
#endif
info.mCSP = csp; // Default CSP permissions for now. These will be overrided if necessary
if (info.mCSP) { // based on the script CSP headers during load in ScriptLoader.
rv = info.mCSP->GetAllowsEval(&info.mReportCSPViolations, info.mEvalAllowed = true;
&info.mEvalAllowed); info.mReportCSPViolations = false;
if (NS_WARN_IF(NS_FAILED(rv))) {
return rv;
}
} else {
info.mEvalAllowed = true;
info.mReportCSPViolations = false;
}
WorkerPrivate::OverrideLoadInfoLoadGroup(info); WorkerPrivate::OverrideLoadInfoLoadGroup(info);