From bfabbcd311405ef312387b1093c72b93e006b742 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Wed, 3 Jan 2024 15:34:22 -0600
Subject: [PATCH] Issue #2402 - Ignore empty CSP directives.
 https://bugzilla.mozilla.org/show_bug.cgi?id=1439425

---
 dom/security/nsCSPParser.cpp | 4 ++++
 dom/security/nsCSPUtils.cpp  | 7 +++++++
 dom/security/nsCSPUtils.h    | 1 +
 3 files changed, 12 insertions(+)

diff --git a/dom/security/nsCSPParser.cpp b/dom/security/nsCSPParser.cpp
index 1012efe878..36505877ae 100644
--- a/dom/security/nsCSPParser.cpp
+++ b/dom/security/nsCSPParser.cpp
@@ -1115,6 +1115,10 @@ nsCSPParser::directive()
     return;
   }
 
+  if (CSP_IsEmptyDirective(mCurValue, mCurToken)) {
+    return;
+  }
+
   // Try to create a new CSPDirective
   nsCSPDirective* cspDir = directiveName();
   if (!cspDir) {
diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
index 9459c65cf0..b73bea30a5 100644
--- a/dom/security/nsCSPUtils.cpp
+++ b/dom/security/nsCSPUtils.cpp
@@ -292,6 +292,13 @@ CSP_CreateHostSrcFromSelfURI(nsIURI* aSelfURI)
   return hostsrc;
 }
 
+bool
+CSP_IsEmptyDirective(const nsAString& aValue, const nsAString& aDir)
+{
+  return (aDir.Length() == 0 &&
+          aValue.Length() == 0);
+}
+
 bool
 CSP_IsValidDirective(const nsAString& aDir)
 {
diff --git a/dom/security/nsCSPUtils.h b/dom/security/nsCSPUtils.h
index b06f9d3c84..b4c48fb42d 100644
--- a/dom/security/nsCSPUtils.h
+++ b/dom/security/nsCSPUtils.h
@@ -235,6 +235,7 @@ nsresult CSP_AppendCSPFromHeader(nsIContentSecurityPolicy* aCsp,
 class nsCSPHostSrc;
 
 nsCSPHostSrc* CSP_CreateHostSrcFromSelfURI(nsIURI* aSelfURI);
+bool CSP_IsEmptyDirective(const nsAString& aValue, const nsAString& aDir);
 bool CSP_IsValidDirective(const nsAString& aDir);
 bool CSP_IsDirective(const nsAString& aValue, CSPDirective aDir);
 bool CSP_IsKeyword(const nsAString& aValue, enum CSPKeyword aKey);