From 8535573f0768ac5c9b30344196b001ca8447dd75 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Fri, 7 Mar 2025 15:12:56 +0100 Subject: [PATCH 1/3] No issue - fix some minor link issues in about:rights Privacy was moved to a subdir. Also replacing http with https because that is what everyone expects by default. --- toolkit/content/aboutRights.xhtml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/toolkit/content/aboutRights.xhtml b/toolkit/content/aboutRights.xhtml index cdd94e13cd..20050f374d 100644 --- a/toolkit/content/aboutRights.xhtml +++ b/toolkit/content/aboutRights.xhtml @@ -28,13 +28,13 @@

&rights.intro;

From a2c6127832ba5ea1f24e586bb25661b0a275c2d6 Mon Sep 17 00:00:00 2001 From: Shadow Date: Fri, 7 Mar 2025 15:53:05 +0000 Subject: [PATCH 2/3] No Issue - Make nsCSPService cancel the channel if a redirect is blocked by CSP Bug 1338304 --- dom/security/nsCSPService.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dom/security/nsCSPService.cpp b/dom/security/nsCSPService.cpp index 7ba531030d..0b3054cfec 100644 --- a/dom/security/nsCSPService.cpp +++ b/dom/security/nsCSPService.cpp @@ -278,7 +278,11 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel, */ nsCOMPtr originalUri; rv = oldChannel->GetOriginalURI(getter_AddRefs(originalUri)); - NS_ENSURE_SUCCESS(rv, rv); + if (NS_FAILED(rv)) { + autoCallback.DontCallback(); + oldChannel->Cancel(NS_ERROR_DOM_BAD_URI); + return rv; + } bool isPreload = nsContentUtils::IsPreloadType(policyType); @@ -310,6 +314,7 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel, // is no point in checking the real policy if (NS_CP_REJECTED(aDecision)) { autoCallback.DontCallback(); + oldChannel->Cancel(NS_ERROR_DOM_BAD_URI); return NS_BINDING_FAILED; } } @@ -333,6 +338,7 @@ CSPService::AsyncOnChannelRedirect(nsIChannel *oldChannel, // if ShouldLoad doesn't accept the load, cancel the request if (!NS_CP_ACCEPTED(aDecision)) { autoCallback.DontCallback(); + oldChannel->Cancel(NS_ERROR_DOM_BAD_URI); return NS_BINDING_FAILED; } return NS_OK; From c318657acd3d8896dd07aeaa2777c1dee69d544b Mon Sep 17 00:00:00 2001 From: Shadow Date: Mon, 10 Mar 2025 22:02:20 +0000 Subject: [PATCH 3/3] Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP() (#2696) Bug 1330035 Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/2696 Co-authored-by: Shadow Co-committed-by: Shadow --- dom/security/nsCSPService.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/dom/security/nsCSPService.cpp b/dom/security/nsCSPService.cpp index 0b3054cfec..ec32889acf 100644 --- a/dom/security/nsCSPService.cpp +++ b/dom/security/nsCSPService.cpp @@ -75,19 +75,23 @@ subjectToCSP(nsIURI* aURI, nsContentPolicyType aContentType) { if (NS_SUCCEEDED(rv) && match) { return true; } - // finally we have to whitelist "about:" which does not fall in - // any of the two categories underneath but is not subject to CSP. + + // Finally we have to whitelist "about:" which does not fall into + // the category underneath and also "javascript:" which is not + // subject to CSP content loading rules. rv = aURI->SchemeIs("about", &match); if (NS_SUCCEEDED(rv) && match) { return false; } + rv = aURI->SchemeIs("javascript", &match); + if (NS_SUCCEEDED(rv) && match) { + return false; + } // Other protocols are not subject to CSP and can be whitelisted: // * URI_IS_LOCAL_RESOURCE // e.g. chrome:, data:, blob:, resource:, moz-icon: // * URI_INHERITS_SECURITY_CONTEXT - // e.g. javascript: - // // Please note that it should be possible for websites to // whitelist their own protocol handlers with respect to CSP, // hence we use protocol flags to accomplish that.