wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2402 - CSP violation: blockedURI inline/eval. https://bugzilla.mozilla.org/show_bug.cgi?id=1418241 CSP: Blocked URI should be empty for inline violations. https://bugzilla.mozilla.org/show_bug.cgi?id=1236222

Browse source
This commit is contained in:
Brian Smith 2024-01-07 11:48:56 -06:00 • committed by roytam1
commit 9cd8aafeaa
2 changed files with 30 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

54
dom/security/nsCSPContext.cpp
View file

@ -489,7 +489,7 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
if (selfICString) {
selfICString->SetData(nsDependentCString("self"));
selfICString->SetData(nsDependentCString("inline"));
}
nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
@ -652,7 +652,16 @@ nsCSPContext::LogViolationDetails(uint16_t aViolationType,
nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
if (selfICString) {
selfICString->SetData(nsDependentCString("self"));
if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
selfICString->SetData(nsDependentCString("eval"));
} else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
selfICString->SetData(nsDependentCString("inline"));
} else {
// All the other types should have a URL, but just in case, let's use
// 'self' here.
selfICString->SetData(nsDependentCString("self"));
}
}
nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
@ -827,7 +836,8 @@ StripURIForReporting(nsIURI* aURI,
nsresult
nsCSPContext::GatherSecurityPolicyViolationEventData(
nsISupports* aBlockedContentSource,
nsIURI* aBlockedURI,
const nsACString& aBlockedString,
nsIURI* aOriginalURI,
nsAString& aViolatedDirective,
uint32_t aViolatedPolicyIndex,
@ -861,24 +871,12 @@ nsCSPContext::GatherSecurityPolicyViolationEventData(
aViolationEventInit.mReferrer = mReferrer;
// blocked-uri
if (aBlockedContentSource) {
if (aBlockedURI) {
nsAutoCString reportBlockedURI;
nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
// could be a string or URI
if (uri) {
StripURIForReporting(uri, mSelfURI, reportBlockedURI);
} else {
nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
if (cstr) {
cstr->GetData(reportBlockedURI);
}
}
if (reportBlockedURI.IsEmpty()) {
// this can happen for frame-ancestors violation where the violating
// ancestor is cross-origin.
NS_WARNING("No blocked URI (null aBlockedContentSource) for CSP violation report.");
}
StripURIForReporting(aBlockedURI, mSelfURI, reportBlockedURI);
aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(reportBlockedURI);
} else {
aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(aBlockedString);
}
// effective-directive
@ -1198,8 +1196,16 @@ class CSPReportSenderRunnable final : public Runnable
// 0) prepare violation data
mozilla::dom::SecurityPolicyViolationEventInit init;
// mBlockedContentSource could be a URI or a string.
nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
// if mBlockedContentSource is not a URI, it could be a string
nsCOMPtr<nsISupportsCString> blockedICString = do_QueryInterface(mBlockedContentSource);
nsAutoCString blockedDataStr;
if (blockedICString) {
blockedICString->GetData(blockedDataStr);
}
rv = mCSPContext->GatherSecurityPolicyViolationEventData(
mBlockedContentSource, mOriginalURI,
blockedURI, blockedDataStr, mOriginalURI,
mViolatedDirective, mViolatedPolicyIndex,
mSourceFile, mScriptSample, mLineNum,
init);
@ -1217,12 +1223,6 @@ class CSPReportSenderRunnable final : public Runnable
mCSPContext->SendReports(init, mViolatedPolicyIndex);
// 3) log to console (one per policy violation)
// mBlockedContentSource could be a URI or a string.
nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
// if mBlockedContentSource is not a URI, it could be a string
nsCOMPtr<nsISupportsCString> blockedString = do_QueryInterface(mBlockedContentSource);
nsCString blockedDataStr;
if (blockedURI) {
blockedURI->GetSpec(blockedDataStr);
@ -1232,8 +1232,6 @@ class CSPReportSenderRunnable final : public Runnable
blockedDataStr.Truncate(40);
blockedDataStr.AppendASCII("...");
}
} else if (blockedString) {
blockedString->GetData(blockedDataStr);
}
if (blockedDataStr.Length() > 0) {

8
dom/security/nsCSPContext.h
View file

@ -61,9 +61,8 @@ class nsCSPContext : public nsIContentSecurityPolicy
/**
* Construct SecurityPolicyViolationEventInit structure.
*
* @param aBlockedContentSource
* Either a CSP Source (like 'self', as string) or nsIURI: the source
* of the violation.
* @param aBlockedURI
* A nsIURI: the source of the violation.
* @param aOriginalUri
* The original URI if the blocked content is a redirect, else null
* @param aViolatedDirective
@ -78,7 +77,8 @@ class nsCSPContext : public nsIContentSecurityPolicy
* The output
*/
nsresult GatherSecurityPolicyViolationEventData(
nsISupports* aBlockedContentSource,
nsIURI* aBlockedURI,
const nsACString& aBlockedString,
nsIURI* aOriginalURI,
nsAString& aViolatedDirective,
uint32_t aViolatedPolicyIndex,