Bug 1958801: Add CSP to geckoview.xhtml r=geckoview-reviewers,nalexander

Differential Revision: https://phabricator.services.mozilla.com/D245441

dom/security/nsContentSecurityUtils.cpp

@@ -1969,7 +1969,6 @@ void nsContentSecurityUtils::AssertChromePageHasCSP(Document* aDocument) {
   }
 
   static nsLiteralCString sAllowedChromePagesWithNoCSP[] = {
-      "chrome://geckoview/content/geckoview.xhtml"_ns,
       // Test files
       "chrome://mochikit/"_ns,
       "chrome://mochitests/"_ns,

mobile/shared/chrome/geckoview/geckoview.js

@@ -541,10 +541,7 @@ function createBrowser() {
   // This is only needed for mochitests, so that they honor the
   // prefers-color-scheme.content-override pref. GeckoView doesn't set this
   // pref to anything other than the default value otherwise.
-  browser.setAttribute(
-    "style",
-    "color-scheme: env(-moz-content-preferred-color-scheme)"
-  );
+  browser.style.colorScheme = "env(-moz-content-preferred-color-scheme)";
 
   return browser;
 }
@@ -954,3 +951,5 @@ function startup() {
 
   InitializationTracker.onInitialized(performance.now());
 }
+
+window.addEventListener("DOMContentLoaded", startup, { once: true });

mobile/shared/chrome/geckoview/geckoview.xhtml

@@ -3,6 +3,8 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
+<?csp default-src chrome: resource:; ?>
+
 <window
   id="main-window"
   windowtype="navigator:geckoview"
@@ -12,8 +14,4 @@
     type="application/javascript"
     src="chrome://geckoview/content/geckoview.js"
   />
-  <script>
-    /* import-globals-from geckoview.js */
-    window.addEventListener("DOMContentLoaded", startup, { once: true });
-  </script>
 </window>