wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-06 15:58:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2466 - Part 2: Implement script-src-elem and script-src-attr

Browse source
This commit is contained in:
Moonchild 2024-02-04 20:15:14 +01:00 • committed by roytam1
commit ff01a35bdb
12 changed files with 117 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

13
dom/security/nsCSPContext.cpp
View file

@ -499,12 +499,14 @@ nsCSPContext::reportInlineViolation(CSPDirective aDirective,
// let's report the hash error; no need to report the unsafe-inline error
// anymore.
if (!aNonce.IsEmpty()) {
observerSubject = (aDirective == SCRIPT_SRC_DIRECTIVE)
observerSubject = (aDirective == SCRIPT_SRC_ELEM_DIRECTIVE ||
aDirective == SCRIPT_SRC_ATTR_DIRECTIVE)
? NS_LITERAL_STRING(SCRIPT_NONCE_VIOLATION_OBSERVER_TOPIC)
: NS_LITERAL_STRING(STYLE_NONCE_VIOLATION_OBSERVER_TOPIC);
}
else {
observerSubject = (aDirective == SCRIPT_SRC_DIRECTIVE)
observerSubject = (aDirective == SCRIPT_SRC_ELEM_DIRECTIVE ||
aDirective == SCRIPT_SRC_ATTR_DIRECTIVE)
? NS_LITERAL_STRING(SCRIPT_HASH_VIOLATION_OBSERVER_TOPIC)
: NS_LITERAL_STRING(STYLE_HASH_VIOLATION_OBSERVER_TOPIC);
}
@ -565,8 +567,11 @@ nsCSPContext::GetAllowsInline(CSPDirective aDirective,
{
*outAllowsInline = true;
if (aDirective != SCRIPT_SRC_DIRECTIVE && aDirective != STYLE_SRC_DIRECTIVE) {
MOZ_ASSERT(false, "can only allow inline for script or style");
if (aDirective != SCRIPT_SRC_ELEM_DIRECTIVE &&
aDirective != SCRIPT_SRC_ATTR_DIRECTIVE &&
aDirective != STYLE_SRC_DIRECTIVE) {
MOZ_ASSERT(false,
"can only allow inline for script-src-(attr/elem) or style");
return NS_OK;
}