wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity
7,727 commits 7 branches 15 tags 557 MiB
Commit graph

87 commits

Author SHA1 Message Date
ownedbywuigi
8046f8b4aa try to fix the images not rendering on yeezy.com 2026-03-27 17:07:32 +00:00
Moonchild
aee2800d48 Issue #2914 - Explicitly allow mixed content websockets on localhost. 
This carves out an exception for hard-coded loopback addresses to allow
`ws:` connections from `https:` to allow mixed-mode from secure pages.

Resolves #2914
 2026-03-08 22:43:35 +00:00
roytam1
be6796bb20 Merge remote-tracking branch 'origin/tracking' into custom 2025-07-25 07:33:44 +08:00
Moonchild
0a8f50fafa No issue - Adjust CSP URI reporting more closely with the spec. 
According to the W3C discussion we should allow websocket URIs to be
reported aside from http/https/ftp ones.
This rewrites things slightly and updates comments to clarify.
We do retain the non-standard reduction to origin only in case the
report is for cross-origin URIs (stops leaking full URIs to the CSP
reported destination).
See https://github.com/w3c/webappsec-csp/issues/735
 2025-07-25 07:30:32 +08:00
roytam1
6414271c91 Merge remote-tracking branch 'origin/tracking' into custom 2025-06-17 09:32:50 +08:00
Moonchild
51022b98b2 Issue #2734 - Add base-64 grammar check to CSP nonces where applicable. 
Resolves #2734
 2025-06-17 09:29:05 +08:00
roytam1
296db1641b Merge remote-tracking branch 'origin/tracking' into custom 2025-05-14 15:49:14 +08:00
Moonchild
9847e9f759 Issue #2736 - Part 13: Override page CSP for loads by expanded principals. 
Per the CSP specification, content injected by extensions is meant to
be exempt from page CSP. This patch takes care of the most common case
of content injected by extension content scripts, which always have
expanded principals which inherit from the page principal.

To make this easier, de-virtualize BasePrincipal::Kind(), using CTOR
initializers instead.
 2025-05-14 15:48:54 +08:00
roytam1
e72f8a3a81 Merge remote-tracking branch 'origin/tracking' into custom 2025-05-14 14:36:05 +08:00
Moonchild
9ad680cfc4 Issue #2736 - Part 1: Provide more consistent principals to CSP. 
We're currently fairly vague and inconsistent about the values we provide to
content policy implementations for requestOrigin and requestPrincipal. In some
cases they're the triggering principal, sometimes the loading principal,
sometimes the channel principal.

Our existing content policy implementations which require or expect a
loading principal currently retrieve it from the context node.
Since no current callers require the principal to be the loading
principal, and some already expect it to be the triggering principal
(which there's currently no other way to retrieve), a choice was made
to pass the triggering principal whenever possible, but use the loading
principal to determine the origin URL.
 2025-05-14 14:21:46 +08:00
roytam1
6792dc4b66 Merge remote-tracking branch 'origin/tracking' into custom 2025-04-30 23:06:47 +08:00
Moonchild
0331e633bd Issue #2728 - Remove obsolete CSP referrer policy. 
This has been superseded by the dedicated Referrer-policy header.
Resolves #2728
 2025-04-30 22:58:43 +08:00
roytam1
a66a8fe8be Merge remote-tracking branch 'origin/tracking' into custom 2025-03-12 10:32:44 +08:00
Shadow
c318657acd Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP() (#2696) 
Bug 1330035

Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/2696
Co-authored-by: Shadow <shadow@no-reply.palemoon.org>
Co-committed-by: Shadow <shadow@no-reply.palemoon.org>
 2025-03-12 10:31:54 +08:00
Shadow
a2c6127832 No Issue - Make nsCSPService cancel the channel if a redirect is blocked by CSP 
Bug 1338304
 2025-03-12 10:31:37 +08:00
roytam1
0d63037e56 dom/security: remove terse static assert from upstream changes 2025-02-18 19:17:37 +08:00
Moonchild
c41c1c63d5 [DOM] Honor security.csp.reporting.enabled pref in more places. 2025-02-18 19:11:24 +08:00
Moonchild
fffe6c4996 Issue #2542 - Part 7: Move SecFetch.* to /netwerk where it belongs. 2024-07-10 14:49:06 +08:00
Moonchild
53149ed646 Issue #2542 - Part 6: Add Sec-Fetch-User header for all requests that are the direct result of a system principal request. 
This means navigation resulting from interaction with the browser UI
should result in a -user header (address bar navigation, bookmarks, etc.)
 2024-07-10 14:48:35 +08:00
Moonchild
0ef8b05101 Issue #2542 - Part 5: Assume browser-initiated requests for unspecified content types to always be user-triggered. 2024-07-10 14:48:15 +08:00
Moonchild
9846090a38 Issue #2542 - Part 4b: Fix pointer mess-up. 2024-07-10 14:47:58 +08:00
Moonchild
65a588ba17 Issue #2542 - Part 4: Use BasePrincipal's IsSameOrigin() in SecFetch. 2024-07-10 14:47:20 +08:00
Moonchild
8ee9e3bc52 Issue #2542 - Part 2b: Fix typo in pref check 2024-07-10 14:46:36 +08:00
Moonchild
8076de8965 Issue #2542 - Part 2: Base implementation of Sec-Fetch-* header code. 
Currently following Mozilla putting stuff in /dom for additional porting,
but it's actually the wrong location since it belongs in /netwerk with
the other code that deals with http headers.
 2024-07-10 14:45:39 +08:00
Moonchild
1f4b858be2 Issue #2542 - Part 1b: Fix dom.securecontext.whitelist code issues 
Some minor bugfixes (wrong condition and string type)
 2024-07-10 14:44:56 +08:00
Moonchild
0c71a6ada0 Issue #2542 - Part 1: Factor out Potentially Trustworthy URI checks. 
For sake of ease of use, converted to boolean functions that just assume "false"
in case of errors.

Note: Mozilla makes special arrangements for .onion addresses as well but
we explicitly do not adopt that. TOR browser can do that all day if it wants.
 2024-07-10 14:44:37 +08:00
Moonchild
721ded9b48 Issue #2466 - Part 3: Implement style-src-elem and style-src-attr 2024-02-08 14:33:59 +08:00
Moonchild
ff01a35bdb Issue #2466 - Part 2: Implement script-src-elem and script-src-attr 2024-02-08 14:33:43 +08:00
Moonchild
4ea2206c15 Issue #2466 - Part 1: Reduce nsContentPolicy type usage. 
Use CSPDirective instead, since it directly deals with CSP anyway.
This cleanup prepares for the following changes.
 2024-02-08 14:33:28 +08:00
Brian Smith
b842a1937a Issue #2402 - Fill in column in CSP Report. 2024-01-11 09:51:07 +08:00
Brian Smith
e21d466d13 Issue #2402 - Print Related JS-Line on CSP Violation (if any). https://bugzilla.mozilla.org/show_bug.cgi?id=1100630 2024-01-11 09:50:49 +08:00
Brian Smith
5b068f3726 Issue #2402 - CSP Violation events should have the correct sample for inline contexts. https://bugzilla.mozilla.org/show_bug.cgi?id=1473587 Add preference to increase max length of CSP report source sample. https://bugzilla.mozilla.org/show_bug.cgi?id=1415352 Return valid columnNumber value in CSP violation events. https://bugzilla.mozilla.org/show_bug.cgi?id=1418246 2024-01-11 09:50:12 +08:00
Brian Smith
e74612e23e Issue #2402 - Workers.setTimeout/setInterval must handle CSP rejections. https://bugzilla.mozilla.org/show_bug.cgi?id=1490165 Has some namespace issues adding the files, so differs slightly. 2024-01-11 09:47:22 +08:00
Brian Smith
9cd8aafeaa Issue #2402 - CSP violation: blockedURI inline/eval. https://bugzilla.mozilla.org/show_bug.cgi?id=1418241 CSP: Blocked URI should be empty for inline violations. https://bugzilla.mozilla.org/show_bug.cgi?id=1236222 2024-01-11 09:46:53 +08:00
Brian Smith
6979441734 Issue #2402 - importScripts should be governed by script-src in Web Workers. https://bugzilla.mozilla.org/show_bug.cgi?id=1322111 Add TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS content policy. Update the Cache API schema to account for new nsIContentPolicy type. 2024-01-11 09:45:52 +08:00
Brian Smith
1e0851158e Issue #2402 - Fix SecurityPolicyViolationEvent.violatedDirective. https://bugzilla.mozilla.org/show_bug.cgi?id=1418243 2024-01-11 09:43:27 +08:00
Brian Smith
ec29404083 Issue #2402 - Implement security policy violation event. https://bugzilla.mozilla.org/show_bug.cgi?id=1037335 2024-01-11 09:43:10 +08:00
Brian Smith
1349cf2d01 Issue #2402 - Remove child-src deprecation warning. https://bugzilla.mozilla.org/show_bug.cgi?id=1486331 2024-01-11 09:42:51 +08:00
Brian Smith
bfabbcd311 Issue #2402 - Ignore empty CSP directives. https://bugzilla.mozilla.org/show_bug.cgi?id=1439425 2024-01-11 09:42:36 +08:00
Moonchild
f1f9dde29e Issue #2405 - Add a pref to disable CSP reporting. 
Resolves #2405
 2023-12-21 10:15:17 +08:00
Moonchild
71ce058b03 [DOM] Check if rootDoc is secure context for web compat 2023-11-24 17:04:52 +08:00
Moonchild
95120acbb2 [DOM security] Be more explicit about CSP checks and reports. 2022-09-22 10:18:33 +08:00
Moonchild
5dfded811d Issue #80 - reinstated unified building for some large chunks of our code. 
This should reduce compile complexity saving time and reducing linker stress.
 2022-09-07 10:36:23 +08:00
Moonchild
3caca43d30 Issue #1710 - Check for triggering principal URI in FTP subresource check. 
Resolves #1710
 2021-01-14 22:19:17 +08:00
Moonchild
0cd673d720 Issue #1656 - Part 6: Clean up the build files 2020-09-25 22:04:23 +08:00
Moonchild
ed7e49eda6 Issue #1656 - Part 2: Unmangle some unfortunate UTF-8 victims. 
The poor fellows got lost in an ASCII-interpretation of the world.
 2020-09-25 22:04:14 +08:00
Moonchild
8c395520d9 Issue #1656 - Part 1: Nuke most vim config lines in the tree. 
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
 2020-09-25 22:04:12 +08:00
Moonchild
b6d9a013c8 Issue #80 - De-unify dom/security 
Exception: CSPUtils relies on something in CSPContext, but on
Windows it throws in an MSVC include which provides no hints.
 2020-05-02 08:25:00 +08:00
wolfbeast
2537698cd2 [CSP] Allow not having a Port for RessourceURI if the Scheme has no 
Default Port
 2020-02-13 07:17:36 +08:00
wolfbeast
c2fafd67b0 Fix whitelisting of JavaScript-uris by CSP hash. 2019-09-06 23:50:03 +08:00