Issue #2736 - Part 14: Make CSP-enabled available to workers.

dom/base/nsContentUtils.cpp

@@ -8980,6 +8980,25 @@ nsContentUtils::StreamsEnabled(JSContext* aCx, JSObject* aObj)
   return workerPrivate->StreamsEnabled();
 }
 
+// static
+bool
+nsContentUtils::CSPEnabled(JSContext* aCx, JSObject* aObj)
+{
+  if (NS_IsMainThread()) {
+    return Preferences::GetBool("security.csp.enabled", true);
+  }
+
+  using namespace workers;
+
+  // Otherwise, check the pref via the WorkerPrivate
+  WorkerPrivate* workerPrivate = GetWorkerPrivateFromContext(aCx);
+  if (!workerPrivate) {
+    return false;
+  }
+
+  return workerPrivate->CSPEnabled();
+}
+
 // static
 bool
 nsContentUtils::IsNonSubresourceRequest(nsIChannel* aChannel)

dom/base/nsContentUtils.h

@@ -2798,6 +2798,8 @@ public:
 
   static bool PushEnabled(JSContext* aCx, JSObject* aObj);
   
+  static bool CSPEnabled(JSContext* aCx, JSObject* aObj);
+  
   static bool StreamsEnabled(JSContext* aCx, JSObject* aObj);
 
   static bool IsNonSubresourceRequest(nsIChannel* aChannel);

dom/workers/RuntimeService.cpp

@@ -578,7 +578,7 @@ ContentSecurityPolicyAllows(JSContext* aCx, JS::HandleValue aValue)
   WorkerPrivate* worker = GetWorkerPrivateFromContext(aCx);
   worker->AssertIsOnWorkerThread();
 
-  if (worker->GetReportCSPViolations()) {
+  if (worker->CSPEnabled() && worker->GetReportCSPViolations()) {
     JS::Rooted<JSString*> jsString(aCx, JS::ToString(aCx, aValue));
     if (NS_WARN_IF(!jsString)) {
       JS_ClearPendingException(aCx);
@@ -2715,6 +2715,7 @@ LogViolationDetailsRunnable::MainThreadRun()
 {
   AssertIsOnMainThread();
 
+  if (mWorkerPrivate->CSPEnabled()) {
     nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
     if (csp) {
       if (mWorkerPrivate->GetReportCSPViolations()) {
@@ -2723,6 +2724,7 @@ LogViolationDetailsRunnable::MainThreadRun()
                                  EmptyString(), EmptyString());
       }
     }
+  }
 
   return true;
 }

dom/workers/ScriptLoader.cpp

@@ -1102,6 +1102,7 @@ private:
         return NS_ERROR_NOT_AVAILABLE;
       }
 
+      if (mWorkerPrivate->CSPEnabled()) {
         httpChannel->GetResponseHeader(
           NS_LITERAL_CSTRING("content-security-policy"),
           tCspHeaderValue);
@@ -1114,6 +1115,7 @@ private:
           NS_LITERAL_CSTRING("referrer-policy"),
           tRPHeaderCValue);
       }
+    }
 
     // May be null.
     nsIDocument* parentDoc = mWorkerPrivate->GetDocument();
@@ -1164,6 +1166,7 @@ private:
       //  by using the SRICheck module
       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
             ("Scriptloader::Load, SRI required but not supported in workers"));
+      if (mWorkerPrivate->CSPEnabled()) {      
         nsCOMPtr<nsIContentSecurityPolicy> wcsp;
         chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
         MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
@@ -1172,6 +1175,7 @@ private:
               nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
               aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
         }
+      }
       return NS_ERROR_SRI_CORRUPT;
     }
 
@@ -1242,7 +1246,9 @@ private:
 
       // We did inherit CSP in bug 1223647. If we do not already have a CSP, we
       // should get it from the HTTP headers on the worker script.
-      if (!mWorkerPrivate->GetCSP() && CSPService::sCSPEnabled) {
+      if (mWorkerPrivate->CSPEnabled() &&
+          !mWorkerPrivate->GetCSP() &&
+          CSPService::sCSPEnabled) {
         rv = mWorkerPrivate->SetCSPFromHeaderValues(tCspHeaderValue,
                                                     tCspROHeaderValue);
         NS_ENSURE_SUCCESS(rv, rv);
@@ -1320,9 +1326,11 @@ private:
       MOZ_ALWAYS_SUCCEEDS(responsePrincipal->Equals(principal, &equal));
       MOZ_DIAGNOSTIC_ASSERT(equal);
 
+      if (mWorkerPrivate->CSPEnabled()) {
         nsCOMPtr<nsIContentSecurityPolicy> csp;
         MOZ_ALWAYS_SUCCEEDS(responsePrincipal->GetCsp(getter_AddRefs(csp)));
         MOZ_DIAGNOSTIC_ASSERT(!csp);
+      }
 #endif
 
       mWorkerPrivate->InitChannelInfo(aChannelInfo);
@@ -1335,10 +1343,12 @@ private:
       rv = mWorkerPrivate->SetPrincipalOnMainThread(responsePrincipal, loadGroup);
       MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
 
+      if (mWorkerPrivate->CSPEnabled()) {
         rv = mWorkerPrivate->SetCSPFromHeaderValues(aCSPHeaderValue,
                                                     aCSPReportOnlyHeaderValue);
         MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
       }
+    }
 
     if (NS_SUCCEEDED(rv)) {
       DataReceived();
@@ -1357,9 +1367,13 @@ private:
         // XHR Params Allowed
         mWorkerPrivate->SetXHRParamsAllowed(parent->XHRParamsAllowed());
 
+        if (mWorkerPrivate->CSPEnabled()) {
           // Set Eval and ContentSecurityPolicy
           mWorkerPrivate->SetCSP(parent->GetCSP());
           mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
+        } else {
+          mWorkerPrivate->SetEvalAllowed(true);
+        }
       }
     }
   }
@@ -1754,10 +1768,12 @@ CacheScriptLoader::ResolvedCallback(JSContext* aCx,
   InternalHeaders* headers = response->GetInternalHeaders();
 
   IgnoredErrorResult ignored;
+  if (nsContentUtils::CSPEnabled(aCx, obj)) {
     headers->Get(NS_LITERAL_CSTRING("content-security-policy"),
                  mCSPHeaderValue, ignored);
     headers->Get(NS_LITERAL_CSTRING("content-security-policy-report-only"),
                  mCSPReportOnlyHeaderValue, ignored);
+  }
 
   nsCOMPtr<nsIInputStream> inputStream;
   response->GetBody(getter_AddRefs(inputStream));

dom/workers/WorkerPrefs.h

@@ -40,6 +40,7 @@ WORKER_SIMPLE_PREF("gfx.offscreencanvas.enabled", OffscreenCanvasEnabled, OFFSCR
 WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPickerEnabled, DOM_WEBKITBLINK_DIRPICKER_WEBKITBLINK)
 WORKER_SIMPLE_PREF("dom.abortController.enabled", AbortControllerEnabled, ABORTCONTROLLER_ENABLED)
 WORKER_SIMPLE_PREF("dom.fetchObserver.enabled", FetchObserverEnabled, FETCHOBSERVER_ENABLED)
+WORKER_SIMPLE_PREF("security.csp.enable", CSPEnabled, CSP_ENABLED)
 WORKER_PREF("dom.workers.latestJSVersion", JSVersionChanged)
 WORKER_PREF("intl.accept_languages", PrefLanguagesChanged)
 WORKER_PREF("general.appname.override", AppNameOverrideChanged)