Issue #2736 - Part 14: Make CSP-enabled available to workers.

dom/base/nsContentUtils.cpp

@@ -8980,6 +8980,25 @@ nsContentUtils::StreamsEnabled(JSContext* aCx, JSObject* aObj)
   return workerPrivate->StreamsEnabled();
 }
 
+// static
+bool
+nsContentUtils::CSPEnabled(JSContext* aCx, JSObject* aObj)
+{
+  if (NS_IsMainThread()) {
+    return Preferences::GetBool("security.csp.enabled", true);
+  }
+
+  using namespace workers;
+
+  // Otherwise, check the pref via the WorkerPrivate
+  WorkerPrivate* workerPrivate = GetWorkerPrivateFromContext(aCx);
+  if (!workerPrivate) {
+    return false;
+  }
+
+  return workerPrivate->CSPEnabled();
+}
+
 // static
 bool
 nsContentUtils::IsNonSubresourceRequest(nsIChannel* aChannel)

dom/base/nsContentUtils.h

@@ -2798,6 +2798,8 @@ public:
 
   static bool PushEnabled(JSContext* aCx, JSObject* aObj);
   
+  static bool CSPEnabled(JSContext* aCx, JSObject* aObj);
+  
   static bool StreamsEnabled(JSContext* aCx, JSObject* aObj);
 
   static bool IsNonSubresourceRequest(nsIChannel* aChannel);

dom/workers/RuntimeService.cpp

@@ -578,7 +578,7 @@ ContentSecurityPolicyAllows(JSContext* aCx, JS::HandleValue aValue)
   WorkerPrivate* worker = GetWorkerPrivateFromContext(aCx);
   worker->AssertIsOnWorkerThread();
 
-  if (worker->GetReportCSPViolations()) {
+  if (worker->CSPEnabled() && worker->GetReportCSPViolations()) {
     JS::Rooted<JSString*> jsString(aCx, JS::ToString(aCx, aValue));
     if (NS_WARN_IF(!jsString)) {
       JS_ClearPendingException(aCx);
@@ -2715,12 +2715,14 @@ LogViolationDetailsRunnable::MainThreadRun()
 {
   AssertIsOnMainThread();
 
-  nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
-  if (csp) {
-    if (mWorkerPrivate->GetReportCSPViolations()) {
-      csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
-                               mFileName, mScriptSample, mLineNum, mColumnNum,
-                               EmptyString(), EmptyString());
+  if (mWorkerPrivate->CSPEnabled()) {
+    nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
+    if (csp) {
+      if (mWorkerPrivate->GetReportCSPViolations()) {
+        csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+                                 mFileName, mScriptSample, mLineNum, mColumnNum,
+                                 EmptyString(), EmptyString());
+      }
     }
   }
 

dom/workers/ScriptLoader.cpp

@@ -1102,17 +1102,19 @@ private:
         return NS_ERROR_NOT_AVAILABLE;
       }
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("content-security-policy"),
-        tCspHeaderValue);
+      if (mWorkerPrivate->CSPEnabled()) {
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("content-security-policy"),
+          tCspHeaderValue);
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("content-security-policy-report-only"),
-        tCspROHeaderValue);
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("content-security-policy-report-only"),
+          tCspROHeaderValue);
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("referrer-policy"),
-        tRPHeaderCValue);
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("referrer-policy"),
+          tRPHeaderCValue);
+      }
     }
 
     // May be null.
@@ -1164,13 +1166,15 @@ private:
       //  by using the SRICheck module
       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
             ("Scriptloader::Load, SRI required but not supported in workers"));
-      nsCOMPtr<nsIContentSecurityPolicy> wcsp;
-      chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
-      MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
-      if (wcsp) {
-        wcsp->LogViolationDetails(
-            nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
-            aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+      if (mWorkerPrivate->CSPEnabled()) {      
+        nsCOMPtr<nsIContentSecurityPolicy> wcsp;
+        chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
+        MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
+        if (wcsp) {
+          wcsp->LogViolationDetails(
+              nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
+              aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+        }
       }
       return NS_ERROR_SRI_CORRUPT;
     }
@@ -1242,7 +1246,9 @@ private:
 
       // We did inherit CSP in bug 1223647. If we do not already have a CSP, we
       // should get it from the HTTP headers on the worker script.
-      if (!mWorkerPrivate->GetCSP() && CSPService::sCSPEnabled) {
+      if (mWorkerPrivate->CSPEnabled() &&
+          !mWorkerPrivate->GetCSP() &&
+          CSPService::sCSPEnabled) {
         rv = mWorkerPrivate->SetCSPFromHeaderValues(tCspHeaderValue,
                                                     tCspROHeaderValue);
         NS_ENSURE_SUCCESS(rv, rv);
@@ -1320,9 +1326,11 @@ private:
       MOZ_ALWAYS_SUCCEEDS(responsePrincipal->Equals(principal, &equal));
       MOZ_DIAGNOSTIC_ASSERT(equal);
 
-      nsCOMPtr<nsIContentSecurityPolicy> csp;
-      MOZ_ALWAYS_SUCCEEDS(responsePrincipal->GetCsp(getter_AddRefs(csp)));
-      MOZ_DIAGNOSTIC_ASSERT(!csp);
+      if (mWorkerPrivate->CSPEnabled()) {
+        nsCOMPtr<nsIContentSecurityPolicy> csp;
+        MOZ_ALWAYS_SUCCEEDS(responsePrincipal->GetCsp(getter_AddRefs(csp)));
+        MOZ_DIAGNOSTIC_ASSERT(!csp);
+      }
 #endif
 
       mWorkerPrivate->InitChannelInfo(aChannelInfo);
@@ -1335,9 +1343,11 @@ private:
       rv = mWorkerPrivate->SetPrincipalOnMainThread(responsePrincipal, loadGroup);
       MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
 
-      rv = mWorkerPrivate->SetCSPFromHeaderValues(aCSPHeaderValue,
-                                                  aCSPReportOnlyHeaderValue);
-      MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+      if (mWorkerPrivate->CSPEnabled()) {
+        rv = mWorkerPrivate->SetCSPFromHeaderValues(aCSPHeaderValue,
+                                                    aCSPReportOnlyHeaderValue);
+        MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+      }
     }
 
     if (NS_SUCCEEDED(rv)) {
@@ -1357,9 +1367,13 @@ private:
         // XHR Params Allowed
         mWorkerPrivate->SetXHRParamsAllowed(parent->XHRParamsAllowed());
 
-        // Set Eval and ContentSecurityPolicy
-        mWorkerPrivate->SetCSP(parent->GetCSP());
-        mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
+        if (mWorkerPrivate->CSPEnabled()) {
+          // Set Eval and ContentSecurityPolicy
+          mWorkerPrivate->SetCSP(parent->GetCSP());
+          mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
+        } else {
+          mWorkerPrivate->SetEvalAllowed(true);
+        }
       }
     }
   }
@@ -1754,10 +1768,12 @@ CacheScriptLoader::ResolvedCallback(JSContext* aCx,
   InternalHeaders* headers = response->GetInternalHeaders();
 
   IgnoredErrorResult ignored;
-  headers->Get(NS_LITERAL_CSTRING("content-security-policy"),
-               mCSPHeaderValue, ignored);
-  headers->Get(NS_LITERAL_CSTRING("content-security-policy-report-only"),
-               mCSPReportOnlyHeaderValue, ignored);
+  if (nsContentUtils::CSPEnabled(aCx, obj)) {
+    headers->Get(NS_LITERAL_CSTRING("content-security-policy"),
+                 mCSPHeaderValue, ignored);
+    headers->Get(NS_LITERAL_CSTRING("content-security-policy-report-only"),
+                 mCSPReportOnlyHeaderValue, ignored);
+  }
 
   nsCOMPtr<nsIInputStream> inputStream;
   response->GetBody(getter_AddRefs(inputStream));

dom/workers/WorkerPrefs.h

@@ -40,6 +40,7 @@ WORKER_SIMPLE_PREF("gfx.offscreencanvas.enabled", OffscreenCanvasEnabled, OFFSCR
 WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPickerEnabled, DOM_WEBKITBLINK_DIRPICKER_WEBKITBLINK)
 WORKER_SIMPLE_PREF("dom.abortController.enabled", AbortControllerEnabled, ABORTCONTROLLER_ENABLED)
 WORKER_SIMPLE_PREF("dom.fetchObserver.enabled", FetchObserverEnabled, FETCHOBSERVER_ENABLED)
+WORKER_SIMPLE_PREF("security.csp.enable", CSPEnabled, CSP_ENABLED)
 WORKER_PREF("dom.workers.latestJSVersion", JSVersionChanged)
 WORKER_PREF("intl.accept_languages", PrefLanguagesChanged)
 WORKER_PREF("general.appname.override", AppNameOverrideChanged)