From 9cd8aafeaac789501e134b3d7a2c32687614f87c Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Sun, 7 Jan 2024 11:48:56 -0600
Subject: [PATCH] Issue #2402 - CSP violation: blockedURI inline/eval.
 https://bugzilla.mozilla.org/show_bug.cgi?id=1418241 CSP: Blocked URI should
 be empty for inline violations.
 https://bugzilla.mozilla.org/show_bug.cgi?id=1236222

---
 dom/security/nsCSPContext.cpp | 54 +++++++++++++++++------------------
 dom/security/nsCSPContext.h   |  8 +++---
 2 files changed, 30 insertions(+), 32 deletions(-)

diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
index 3b74aea09c..5c52d0f201 100644
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -489,7 +489,7 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
 
   nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
   if (selfICString) {
-    selfICString->SetData(nsDependentCString("self"));
+    selfICString->SetData(nsDependentCString("inline"));
   }
   nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
 
@@ -652,7 +652,16 @@ nsCSPContext::LogViolationDetails(uint16_t aViolationType,
 
     nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
     if (selfICString) {
-      selfICString->SetData(nsDependentCString("self"));
+      if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
+        selfICString->SetData(nsDependentCString("eval"));
+      } else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
+                 aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
+        selfICString->SetData(nsDependentCString("inline"));
+      } else {
+        // All the other types should have a URL, but just in case, let's use
+        // 'self' here.
+        selfICString->SetData(nsDependentCString("self"));
+      }
     }
     nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
 
@@ -827,7 +836,8 @@ StripURIForReporting(nsIURI* aURI,
 
 nsresult
 nsCSPContext::GatherSecurityPolicyViolationEventData(
-  nsISupports* aBlockedContentSource,
+  nsIURI* aBlockedURI,
+  const nsACString& aBlockedString,
   nsIURI* aOriginalURI,
   nsAString& aViolatedDirective,
   uint32_t aViolatedPolicyIndex,
@@ -861,24 +871,12 @@ nsCSPContext::GatherSecurityPolicyViolationEventData(
   aViolationEventInit.mReferrer = mReferrer;
 
   // blocked-uri
-  if (aBlockedContentSource) {
+  if (aBlockedURI) {
     nsAutoCString reportBlockedURI;
-    nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
-    // could be a string or URI
-    if (uri) {
-      StripURIForReporting(uri, mSelfURI, reportBlockedURI);
-    } else {
-      nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
-      if (cstr) {
-        cstr->GetData(reportBlockedURI);
-      }
-    }
-    if (reportBlockedURI.IsEmpty()) {
-      // this can happen for frame-ancestors violation where the violating
-      // ancestor is cross-origin.
-      NS_WARNING("No blocked URI (null aBlockedContentSource) for CSP violation report.");
-    }
+    StripURIForReporting(aBlockedURI, mSelfURI, reportBlockedURI);
     aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(reportBlockedURI);
+  } else {
+    aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(aBlockedString);
   }
 
   // effective-directive
@@ -1198,8 +1196,16 @@ class CSPReportSenderRunnable final : public Runnable
 
       // 0) prepare violation data
       mozilla::dom::SecurityPolicyViolationEventInit init;
+      // mBlockedContentSource could be a URI or a string.
+      nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
+      // if mBlockedContentSource is not a URI, it could be a string
+      nsCOMPtr<nsISupportsCString> blockedICString = do_QueryInterface(mBlockedContentSource);
+      nsAutoCString blockedDataStr;
+      if (blockedICString) {
+        blockedICString->GetData(blockedDataStr);
+      }
       rv = mCSPContext->GatherSecurityPolicyViolationEventData(
-        mBlockedContentSource, mOriginalURI,
+        blockedURI, blockedDataStr, mOriginalURI,
         mViolatedDirective, mViolatedPolicyIndex,
         mSourceFile, mScriptSample, mLineNum,
         init);
@@ -1217,12 +1223,6 @@ class CSPReportSenderRunnable final : public Runnable
       mCSPContext->SendReports(init, mViolatedPolicyIndex);
 
       // 3) log to console (one per policy violation)
-      // mBlockedContentSource could be a URI or a string.
-      nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
-      // if mBlockedContentSource is not a URI, it could be a string
-      nsCOMPtr<nsISupportsCString> blockedString = do_QueryInterface(mBlockedContentSource);
-
-      nsCString blockedDataStr;
 
       if (blockedURI) {
         blockedURI->GetSpec(blockedDataStr);
@@ -1232,8 +1232,6 @@ class CSPReportSenderRunnable final : public Runnable
           blockedDataStr.Truncate(40);
           blockedDataStr.AppendASCII("...");
         }
-      } else if (blockedString) {
-        blockedString->GetData(blockedDataStr);
       }
 
       if (blockedDataStr.Length() > 0) {
diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h
index 8a283c1a10..1d3122af80 100644
--- a/dom/security/nsCSPContext.h
+++ b/dom/security/nsCSPContext.h
@@ -61,9 +61,8 @@ class nsCSPContext : public nsIContentSecurityPolicy
     /**
      * Construct SecurityPolicyViolationEventInit structure.
      *
-     * @param aBlockedContentSource
-     *        Either a CSP Source (like 'self', as string) or nsIURI: the source
-     *        of the violation.
+     * @param aBlockedURI
+     *        A nsIURI: the source of the violation.
      * @param aOriginalUri
      *        The original URI if the blocked content is a redirect, else null
      * @param aViolatedDirective
@@ -78,7 +77,8 @@ class nsCSPContext : public nsIContentSecurityPolicy
      *        The output
      */
     nsresult GatherSecurityPolicyViolationEventData(
-      nsISupports* aBlockedContentSource,
+      nsIURI* aBlockedURI,
+      const nsACString& aBlockedString,
       nsIURI* aOriginalURI,
       nsAString& aViolatedDirective,
       uint32_t aViolatedPolicyIndex,