Commit graph

8 commits

Author SHA1 Message Date
Moonchild
9847e9f759 Issue #2736 - Part 13: Override page CSP for loads by expanded principals.
Per the CSP specification, content injected by extensions is meant to
be exempt from page CSP. This patch takes care of the most common case
of content injected by extension content scripts, which always have
expanded principals which inherit from the page principal.

To make this easier, de-virtualize BasePrincipal::Kind(), using CTOR
initializers instead.
2025-05-14 15:48:54 +08:00
Shadow
c318657acd Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP() (#2696)
Bug 1330035

Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/2696
Co-authored-by: Shadow <shadow@no-reply.palemoon.org>
Co-committed-by: Shadow <shadow@no-reply.palemoon.org>
2025-03-12 10:31:54 +08:00
Shadow
a2c6127832 No Issue - Make nsCSPService cancel the channel if a redirect is blocked by CSP
Bug 1338304
2025-03-12 10:31:37 +08:00
Moonchild
f1f9dde29e Issue #2405 - Add a pref to disable CSP reporting.
Resolves #2405
2023-12-21 10:15:17 +08:00
Moonchild
8c395520d9 Issue #1656 - Part 1: Nuke most vim config lines in the tree.
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
2020-09-25 22:04:12 +08:00
janekptacijarabaci
53c39834e6 Bug 1469150 - CSP: Scripts with valid nonce get blocked if URL redirects is fixed (follow up) 2019-02-16 00:04:37 +08:00
janekptacijarabaci
c8131a687a Bug 1469150 - CSP: Scripts with valid nonce get blocked if URL redirects
https://bugzilla.mozilla.org/show_bug.cgi?id=1469150
2019-02-16 00:04:34 +08:00
Roy Tam
dcd9973243 import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00