wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 23:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix whitelisting of JavaScript-uris by CSP hash.

Browse source
This commit is contained in:
wolfbeast 2019-09-05 18:42:49 +02:00 • committed by Roy Tam
commit c2fafd67b0
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
dom/security/nsCSPContext.cpp
View file

@ -513,8 +513,19 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
for (uint32_t i = 0; i < mPolicies.Length(); i++) {
bool allowed =
mPolicies[i]->allows(aContentType, CSP_UNSAFE_INLINE, EmptyString(), aParserCreated) ||
mPolicies[i]->allows(aContentType, CSP_NONCE, aNonce, aParserCreated) ||
mPolicies[i]->allows(aContentType, CSP_HASH, aContent, aParserCreated);
mPolicies[i]->allows(aContentType, CSP_NONCE, aNonce, aParserCreated);
// If the inlined script or style is allowed by either unsafe-inline or the
// nonce, go ahead and shortcut this loop.
if (allowed) {
continue;
}
// Check if the csp-hash matches against the hash of the script.
// If we don't have any content to check, block the script.
if (!aContent.IsEmpty()) {
allowed = mPolicies[i]->allows(aContentType, CSP_HASH, aContent, aParserCreated);
}
if (!allowed) {
// policy is violoated: deny the load unless policy is report only and