corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1958798 - Actually apply the CSP in the interactions viewer. r=simonf,jteow

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D244889
This commit is contained in:
Tom Schuster
2025-04-09 14:08:13 +00:00
parent 046e6a7dce
commit 357d0e78d6
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
browser/components/places/metadataViewer/interactionsViewer.html
View File

@@ -3,12 +3,14 @@
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
<?csp default-src chrome:; img-src chrome: moz-icon:; object-src 'none'; ?>
<!doctype html>
<html>
<head>
<meta
http-equiv="Content-Security-Policy"
content="default-src chrome:; img-src chrome: moz-icon:; style-src chrome: 'unsafe-inline'; object-src 'none';"
/>
<title>Interactions Debug Viewer</title>
<script
type="module"

2
dom/security/nsContentSecurityUtils.cpp
View File

@@ -1247,6 +1247,7 @@ static nsLiteralCString sStyleSrcUnsafeInlineAllowList[] = {
"chrome://browser/content/places/bookmarkProperties.xhtml"_ns,
"chrome://browser/content/places/bookmarksSidebar.xhtml"_ns,
"chrome://browser/content/places/historySidebar.xhtml"_ns,
"chrome://browser/content/places/interactionsViewer.html"_ns,
"chrome://browser/content/places/places.xhtml"_ns,
"chrome://browser/content/preferences/dialogs/applicationManager.xhtml"_ns,
"chrome://browser/content/preferences/dialogs/browserLanguages.xhtml"_ns,
@@ -1958,7 +1959,6 @@ void nsContentSecurityUtils::AssertChromePageHasCSP(Document* aDocument) {
static nsLiteralCString sAllowedChromePagesWithNoCSP[] = {
"chrome://browser/content/default-bookmarks.html"_ns,
"chrome://browser/content/places/interactionsViewer.html"_ns,
"chrome://browser/content/shopping/review-checker.xhtml"_ns,
"chrome://geckoview/content/geckoview.xhtml"_ns,
"chrome://global/content/alerts/alert.xhtml"_ns,