Bug 1960359 - Add a CSP to changepassword.xhtml. r=simonf

Differential Revision: https://phabricator.services.mozilla.com/D245538

dom/security/nsContentSecurityUtils.cpp

@@ -1305,6 +1305,7 @@ static nsLiteralCString sStyleSrcUnsafeInlineAllowList[] = {
     "chrome://mozapps/content/update/history.xhtml"_ns,
     "chrome://mozapps/content/update/updateElevation.xhtml"_ns,
     "chrome://pippki/content/certManager.xhtml"_ns,
+    "chrome://pippki/content/changepassword.xhtml"_ns,
     "chrome://pippki/content/deletecert.xhtml"_ns,
     "chrome://pippki/content/device_manager.xhtml"_ns,
     "chrome://pippki/content/downloadcert.xhtml"_ns,

security/manager/pki/resources/content/changepassword.js

@@ -27,6 +27,16 @@ function onLoad() {
   document.addEventListener("dialogaccept", setPassword);
 
   pw1 = document.getElementById("pw1");
+  pw1.addEventListener("input", () => {
+    setPasswordStrength();
+    checkPasswords();
+  });
+
+  let pw2 = document.getElementById("pw2");
+  pw2.addEventListener("input", () => {
+    checkPasswords();
+  });
+
   params = window.arguments[0].QueryInterface(Ci.nsIDialogParamBlock);
   token = params.objects.GetElementAt(0).QueryInterface(Ci.nsIPK11Token);
 
@@ -209,3 +219,5 @@ function checkPasswords() {
   document.getElementById("set_password").getButton("accept").disabled =
     pw1 != pw2;
 }
+
+window.addEventListener("load", onLoad);

security/manager/pki/resources/content/changepassword.xhtml

@@ -3,13 +3,14 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
+<?csp default-src chrome: resource:; style-src chrome: 'unsafe-inline'; ?>
+
 <!DOCTYPE window>
 
 <window
   data-l10n-id="change-device-password-window"
   xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   xmlns:html="http://www.w3.org/1999/xhtml"
-  onload="onLoad();"
 >
   <dialog id="set_password" buttons="accept,cancel">
     <linkset>
@@ -53,15 +54,11 @@
       </hbox>
       <hbox class="input-row">
         <label flex="1" data-l10n-id="change-password-new" />
-        <html:input
-          id="pw1"
-          type="password"
-          oninput="setPasswordStrength(); checkPasswords();"
-        />
+        <html:input id="pw1" type="password" />
       </hbox>
       <hbox class="input-row">
         <label flex="1" data-l10n-id="change-password-reenter" />
-        <html:input id="pw2" type="password" oninput="checkPasswords();" />
+        <html:input id="pw2" type="password" />
       </hbox>
     </vbox>