wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-27 02:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2405 - Add a pref to disable CSP reporting.

Browse source 
Resolves #2405
This commit is contained in:
Moonchild 2023-12-17 22:56:04 +01:00 • committed by roytam1
commit f1f9dde29e
4 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
dom/security/nsCSPContext.cpp
View file

@ -827,6 +827,16 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
{ {
NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1); NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
if (!CSPService::sCSPReportingEnabled) {
// Reporting is pref-disabled. Don't do any actual work and return success.
nsContentUtils::ReportToConsoleNonLocalized(
NS_LITERAL_STRING("CSP violation report not sent: reports have been disabled contrary to spec."),
nsIScriptError::warningFlag,
NS_LITERAL_CSTRING("Content Security Policy"),
nullptr);
return NS_OK;
}
dom::CSPReport report; dom::CSPReport report;
nsresult rv; nsresult rv;

3
dom/security/nsCSPService.cpp
View file

@ -25,12 +25,15 @@ using namespace mozilla;
/* Keeps track of whether or not CSP is enabled */ /* Keeps track of whether or not CSP is enabled */
bool CSPService::sCSPEnabled = true; bool CSPService::sCSPEnabled = true;
/* Keeps track of whether or not CSP reporting is enabled */
bool CSPService::sCSPReportingEnabled = true;
static LazyLogModule gCspPRLog("CSP"); static LazyLogModule gCspPRLog("CSP");
CSPService::CSPService() CSPService::CSPService()
{ {
Preferences::AddBoolVarCache(&sCSPEnabled, "security.csp.enable"); Preferences::AddBoolVarCache(&sCSPEnabled, "security.csp.enable");
Preferences::AddBoolVarCache(&sCSPReportingEnabled, "security.csp.reporting.enabled");
} }
CSPService::~CSPService() CSPService::~CSPService()

5
dom/security/nsCSPService.h
View file

@ -14,8 +14,8 @@
#define CSPSERVICE_CONTRACTID "@mozilla.org/cspservice;1" #define CSPSERVICE_CONTRACTID "@mozilla.org/cspservice;1"
#define CSPSERVICE_CID \ #define CSPSERVICE_CID \
{ 0x8d2f40b2, 0x4875, 0x4c95, \ { 0x83d284d6, 0xf280, 0x48ae, \
{ 0x97, 0xd9, 0x3f, 0x7d, 0xca, 0x2c, 0xb4, 0x60 } } { 0xa5, 0x6b, 0x0f, 0x28, 0x11, 0x29, 0x83, 0x1b } }
class CSPService : public nsIContentPolicy, class CSPService : public nsIContentPolicy,
public nsIChannelEventSink public nsIChannelEventSink
{ {
@ -26,6 +26,7 @@ public:
CSPService(); CSPService();
static bool sCSPEnabled; static bool sCSPEnabled;
static bool sCSPReportingEnabled;
protected: protected:
virtual ~CSPService(); virtual ~CSPService();

1
modules/libpref/init/all.js
View file

@ -2187,6 +2187,7 @@ pref("security.notification_enable_delay", 500);
pref("security.csp.enable", true); pref("security.csp.enable", true);
pref("security.csp.experimentalEnabled", false); pref("security.csp.experimentalEnabled", false);
pref("security.csp.enableStrictDynamic", true); pref("security.csp.enableStrictDynamic", true);
pref("security.csp.reporting.enabled", true);
// Default Content Security Policy to apply to signed contents. // Default Content Security Policy to apply to signed contents.
pref("security.signed_content.CSP.default", "script-src 'self'; style-src 'self'"); pref("security.signed_content.CSP.default", "script-src 'self'; style-src 'self'");