Backed out 3 changesets (bug 1475073, bug 1304645, bug 1474537) for failing wpt and mochitest on a CLOSED TREE
Backed out changeset 4fbeea69b10d (bug 1475073) Backed out changeset d3ac68d9ead9 (bug 1304645) Backed out changeset 113b601a3b59 (bug 1474537)
This commit is contained in:
@@ -1748,8 +1748,7 @@ HTMLFormElement::GetActionURL(nsIURI** aActionURL,
|
||||
EmptyString(), // aScriptSample
|
||||
0, // aLineNumber
|
||||
0, // aColumnNumber
|
||||
nsIScriptError::warningFlag,
|
||||
NS_LITERAL_CSTRING("upgradeInsecureRequest"),
|
||||
nsIScriptError::warningFlag, "CSP",
|
||||
document->InnerWindowID(),
|
||||
!!document->NodePrincipal()->OriginAttributesRef().mPrivateBrowsingId);
|
||||
}
|
||||
|
||||
@@ -196,8 +196,7 @@ ShouldIgnoreFrameOptions(nsIChannel* aChannel, nsIPrincipal* aPrincipal)
|
||||
0, // no linenumber
|
||||
0, // no columnnumber
|
||||
nsIScriptError::warningFlag,
|
||||
NS_LITERAL_CSTRING("IgnoringSrcBecauseOfDirective"),
|
||||
innerWindowID,
|
||||
"CSP", innerWindowID,
|
||||
privateWindow);
|
||||
|
||||
return true;
|
||||
|
||||
@@ -777,7 +777,6 @@ struct ConsoleMsgQueueElem {
|
||||
uint32_t mLineNumber;
|
||||
uint32_t mColumnNumber;
|
||||
uint32_t mSeverityFlag;
|
||||
nsCString mCategory;
|
||||
};
|
||||
|
||||
void
|
||||
@@ -798,7 +797,7 @@ nsCSPContext::flushConsoleMessages()
|
||||
ConsoleMsgQueueElem &elem = mConsoleMsgQueue[i];
|
||||
CSP_LogMessage(elem.mMsg, elem.mSourceName, elem.mSourceLine,
|
||||
elem.mLineNumber, elem.mColumnNumber,
|
||||
elem.mSeverityFlag, elem.mCategory, mInnerWindowID,
|
||||
elem.mSeverityFlag, "CSP", mInnerWindowID,
|
||||
privateWindow);
|
||||
}
|
||||
mConsoleMsgQueue.Clear();
|
||||
@@ -814,10 +813,6 @@ nsCSPContext::logToConsole(const char* aName,
|
||||
uint32_t aColumnNumber,
|
||||
uint32_t aSeverityFlag)
|
||||
{
|
||||
// we are passing aName as the category so we can link to the
|
||||
// appropriate MDN docs depending on the specific error.
|
||||
nsDependentCString category(aName);
|
||||
|
||||
// let's check if we have to queue up console messages
|
||||
if (mQueueUpMessages) {
|
||||
nsAutoString msg;
|
||||
@@ -829,7 +824,6 @@ nsCSPContext::logToConsole(const char* aName,
|
||||
elem.mLineNumber = aLineNumber;
|
||||
elem.mColumnNumber = aColumnNumber;
|
||||
elem.mSeverityFlag = aSeverityFlag;
|
||||
elem.mCategory = category;
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -839,10 +833,9 @@ nsCSPContext::logToConsole(const char* aName,
|
||||
privateWindow = !!doc->NodePrincipal()->OriginAttributesRef().mPrivateBrowsingId;
|
||||
}
|
||||
|
||||
|
||||
CSP_LogLocalizedStr(aName, aParams, aParamsLength, aSourceName,
|
||||
aSourceLine, aLineNumber, aColumnNumber,
|
||||
aSeverityFlag, category, mInnerWindowID, privateWindow);
|
||||
aSeverityFlag, "CSP", mInnerWindowID, privateWindow);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -129,7 +129,7 @@ CSP_LogMessage(const nsAString& aMessage,
|
||||
uint32_t aLineNumber,
|
||||
uint32_t aColumnNumber,
|
||||
uint32_t aFlags,
|
||||
const nsACString& aCategory,
|
||||
const char *aCategory,
|
||||
uint64_t aInnerWindowID,
|
||||
bool aFromPrivateWindow)
|
||||
{
|
||||
@@ -158,25 +158,20 @@ CSP_LogMessage(const nsAString& aMessage,
|
||||
cspMsg.AppendLiteral(u".");
|
||||
}
|
||||
|
||||
// Since we are leveraging csp errors as the category names which
|
||||
// we pass to devtools, we should prepend them with "CSP_" to
|
||||
// allow easy distincution in devtools code. e.g.
|
||||
// upgradeInsecureRequest -> CSP_upgradeInsecureRequest
|
||||
nsCString category("CSP_");
|
||||
category.Append(aCategory);
|
||||
|
||||
nsresult rv;
|
||||
if (aInnerWindowID > 0) {
|
||||
nsCString catStr;
|
||||
catStr.AssignASCII(aCategory);
|
||||
rv = error->InitWithWindowID(cspMsg, aSourceName,
|
||||
aSourceLine, aLineNumber,
|
||||
aColumnNumber, aFlags,
|
||||
category, aInnerWindowID);
|
||||
catStr, aInnerWindowID);
|
||||
}
|
||||
else {
|
||||
rv = error->Init(cspMsg, aSourceName,
|
||||
aSourceLine, aLineNumber,
|
||||
aColumnNumber, aFlags,
|
||||
category.get(), aFromPrivateWindow);
|
||||
aCategory, aFromPrivateWindow);
|
||||
}
|
||||
if (NS_FAILED(rv)) {
|
||||
return;
|
||||
@@ -196,7 +191,7 @@ CSP_LogLocalizedStr(const char* aName,
|
||||
uint32_t aLineNumber,
|
||||
uint32_t aColumnNumber,
|
||||
uint32_t aFlags,
|
||||
const nsACString& aCategory,
|
||||
const char* aCategory,
|
||||
uint64_t aInnerWindowID,
|
||||
bool aFromPrivateWindow)
|
||||
{
|
||||
@@ -768,11 +763,6 @@ nsCSPHostSrc::visit(nsCSPSrcVisitor* aVisitor) const
|
||||
void
|
||||
nsCSPHostSrc::toString(nsAString& outStr) const
|
||||
{
|
||||
if (mGeneratedFromSelfKeyword) {
|
||||
outStr.AppendASCII("'self'");
|
||||
return;
|
||||
}
|
||||
|
||||
// If mHost is a single "*", we append the wildcard and return.
|
||||
if (mHost.EqualsASCII("*") &&
|
||||
mScheme.IsEmpty() &&
|
||||
|
||||
@@ -33,7 +33,7 @@ void CSP_LogLocalizedStr(const char* aName,
|
||||
uint32_t aLineNumber,
|
||||
uint32_t aColumnNumber,
|
||||
uint32_t aFlags,
|
||||
const nsACString& aCategory,
|
||||
const char* aCategory,
|
||||
uint64_t aInnerWindowID,
|
||||
bool aFromPrivateWindow);
|
||||
|
||||
@@ -50,7 +50,7 @@ void CSP_LogMessage(const nsAString& aMessage,
|
||||
uint32_t aLineNumber,
|
||||
uint32_t aColumnNumber,
|
||||
uint32_t aFlags,
|
||||
const nsACString& aCategory,
|
||||
const char* aCategory,
|
||||
uint64_t aInnerWindowID,
|
||||
bool aFromPrivateWindow);
|
||||
|
||||
|
||||
@@ -803,8 +803,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
||||
EmptyString(), // aScriptSample
|
||||
0, // aLineNumber
|
||||
0, // aColumnNumber
|
||||
nsIScriptError::errorFlag,
|
||||
NS_LITERAL_CSTRING("blockAllMixedContent"),
|
||||
nsIScriptError::errorFlag, "CSP",
|
||||
document->InnerWindowID(),
|
||||
!!document->NodePrincipal()->OriginAttributesRef().mPrivateBrowsingId);
|
||||
*aDecision = REJECT_REQUEST;
|
||||
|
||||
@@ -44,7 +44,7 @@ function receiveMessage(event) {
|
||||
|
||||
var policy = policies[0];
|
||||
var val = policy['img-src'];
|
||||
is(val.toString(), "'self'", "'self' should translate into data");
|
||||
is(val.toString(), "data://", "'self' should translate into data");
|
||||
SimpleTest.finish();
|
||||
}
|
||||
|
||||
|
||||
@@ -52,7 +52,10 @@ function checkResults(reportStr) {
|
||||
is(cspReport["violated-directive"],
|
||||
"style-src",
|
||||
"Incorrect violated-directive");
|
||||
is(cspReport["original-policy"], POLICY, "Incorrect original-policy");
|
||||
is(cspReport["original-policy"],
|
||||
"style-src http://mochi.test:8888; report-uri " +
|
||||
"http://mochi.test:8888/tests/dom/security/test/csp/file_report_for_import_server.sjs?report",
|
||||
"Incorrect original-policy");
|
||||
is(cspReport["blocked-uri"],
|
||||
"http://example.com/tests/dom/security/test/csp/file_report_for_import_server.sjs?stylesheet",
|
||||
"Incorrect blocked-uri");
|
||||
|
||||
@@ -234,7 +234,7 @@ TEST(CSPParser, Keywords)
|
||||
static const PolicyTest policies[] =
|
||||
{
|
||||
{ "script-src 'self'",
|
||||
"script-src 'self'" },
|
||||
"script-src http://www.selfuri.com" },
|
||||
{ "script-src 'unsafe-inline'",
|
||||
"script-src 'unsafe-inline'" },
|
||||
{ "script-src 'unsafe-eval'",
|
||||
@@ -244,7 +244,7 @@ TEST(CSPParser, Keywords)
|
||||
{ "script-src 'none'",
|
||||
"script-src 'none'" },
|
||||
{ "img-src 'none'; script-src 'unsafe-eval' 'unsafe-inline'; default-src 'self'",
|
||||
"img-src 'none'; script-src 'unsafe-eval' 'unsafe-inline'; default-src 'self'" },
|
||||
"img-src 'none'; script-src 'unsafe-eval' 'unsafe-inline'; default-src http://www.selfuri.com" },
|
||||
};
|
||||
|
||||
uint32_t policyCount = sizeof(policies) / sizeof(PolicyTest);
|
||||
@@ -258,7 +258,7 @@ TEST(CSPParser, IgnoreUpperLowerCasePolicies)
|
||||
static const PolicyTest policies[] =
|
||||
{
|
||||
{ "script-src 'SELF'",
|
||||
"script-src 'self'" },
|
||||
"script-src http://www.selfuri.com" },
|
||||
{ "sCriPt-src 'Unsafe-Inline'",
|
||||
"script-src 'unsafe-inline'" },
|
||||
{ "SCRIPT-src 'unsafe-eval'",
|
||||
@@ -268,7 +268,7 @@ TEST(CSPParser, IgnoreUpperLowerCasePolicies)
|
||||
{ "script-src 'NoNe'",
|
||||
"script-src 'none'" },
|
||||
{ "img-sRc 'noNe'; scrIpt-src 'unsafe-EVAL' 'UNSAFE-inline'; deFAULT-src 'Self'",
|
||||
"img-src 'none'; script-src 'unsafe-eval' 'unsafe-inline'; default-src 'self'" },
|
||||
"img-src 'none'; script-src 'unsafe-eval' 'unsafe-inline'; default-src http://www.selfuri.com" },
|
||||
{ "default-src HTTP://www.example.com",
|
||||
"default-src http://www.example.com" },
|
||||
{ "default-src HTTP://WWW.EXAMPLE.COM",
|
||||
@@ -418,9 +418,9 @@ TEST(CSPParser, SimplePolicies)
|
||||
{ "script-src 'unsafe-eval' 'unsafe-inline' http://www.example.com",
|
||||
"script-src 'unsafe-eval' 'unsafe-inline' http://www.example.com" },
|
||||
{ "object-src 'self'",
|
||||
"object-src 'self'" },
|
||||
"object-src http://www.selfuri.com" },
|
||||
{ "style-src http://www.example.com 'self'",
|
||||
"style-src http://www.example.com 'self'" },
|
||||
"style-src http://www.example.com http://www.selfuri.com" },
|
||||
{ "media-src http://www.example.com http://www.test.com",
|
||||
"media-src http://www.example.com http://www.test.com" },
|
||||
{ "connect-src http://www.test.com example.com *.other.com;",
|
||||
@@ -430,13 +430,13 @@ TEST(CSPParser, SimplePolicies)
|
||||
{ "style-src *.other.com example.com",
|
||||
"style-src http://*.other.com http://example.com"},
|
||||
{ "default-src 'self'; img-src *;",
|
||||
"default-src 'self'; img-src *" },
|
||||
"default-src http://www.selfuri.com; img-src *" },
|
||||
{ "object-src media1.example.com media2.example.com *.cdn.example.com;",
|
||||
"object-src http://media1.example.com http://media2.example.com http://*.cdn.example.com" },
|
||||
{ "script-src trustedscripts.example.com",
|
||||
"script-src http://trustedscripts.example.com" },
|
||||
{ "script-src 'self' ; default-src trustedscripts.example.com",
|
||||
"script-src 'self'; default-src http://trustedscripts.example.com" },
|
||||
"script-src http://www.selfuri.com; default-src http://trustedscripts.example.com" },
|
||||
{ "default-src 'none'; report-uri http://localhost:49938/test",
|
||||
"default-src 'none'; report-uri http://localhost:49938/test" },
|
||||
{ " ; default-src abc",
|
||||
@@ -476,7 +476,7 @@ TEST(CSPParser, PoliciesWithInvalidSrc)
|
||||
static const PolicyTest policies[] =
|
||||
{
|
||||
{ "script-src 'self'; SCRIPT-SRC http://www.example.com",
|
||||
"script-src 'self'" },
|
||||
"script-src http://www.selfuri.com" },
|
||||
{ "script-src 'none' test.com; script-src example.com",
|
||||
"script-src http://test.com" },
|
||||
{ "default-src **",
|
||||
@@ -593,7 +593,7 @@ TEST(CSPParser, GoodGeneratedPolicies)
|
||||
static const PolicyTest policies[] =
|
||||
{
|
||||
{ "default-src 'self'; img-src *",
|
||||
"default-src 'self'; img-src *" },
|
||||
"default-src http://www.selfuri.com; img-src *" },
|
||||
{ "report-uri /policy",
|
||||
"report-uri http://www.selfuri.com/policy"},
|
||||
{ "img-src *",
|
||||
@@ -695,7 +695,7 @@ TEST(CSPParser, GoodGeneratedPolicies)
|
||||
{ "default-src bar.com; script-src https://foo.com",
|
||||
"default-src http://bar.com; script-src https://foo.com" },
|
||||
{ "default-src 'self'; script-src 'self' https://*:*",
|
||||
"default-src 'self'; script-src 'self' https://*:*" },
|
||||
"default-src http://www.selfuri.com; script-src http://www.selfuri.com https://*:*" },
|
||||
{ "img-src http://self.com:34",
|
||||
"img-src http://self.com:34" },
|
||||
{ "media-src http://subd.self.com:34",
|
||||
@@ -757,7 +757,7 @@ TEST(CSPParser, GoodGeneratedPolicies)
|
||||
{ "font-src http://self.com/",
|
||||
"font-src http://self.com/" },
|
||||
{ "script-src 'self'",
|
||||
"script-src 'self'" },
|
||||
"script-src http://www.selfuri.com" },
|
||||
{ "default-src http://self.com/foo.png",
|
||||
"default-src http://self.com/foo.png" },
|
||||
{ "script-src http://self.com/foo.js",
|
||||
@@ -771,25 +771,25 @@ TEST(CSPParser, GoodGeneratedPolicies)
|
||||
{ "media-src http",
|
||||
"media-src http://http" },
|
||||
{ "frame-src 'SELF'",
|
||||
"frame-src 'self'" },
|
||||
"frame-src http://www.selfuri.com" },
|
||||
{ "DEFAULT-src 'self';",
|
||||
"default-src 'self'" },
|
||||
"default-src http://www.selfuri.com" },
|
||||
{ "default-src 'self' http://FOO.COM",
|
||||
"default-src 'self' http://foo.com" },
|
||||
"default-src http://www.selfuri.com http://foo.com" },
|
||||
{ "default-src 'self' HTTP://foo.com",
|
||||
"default-src 'self' http://foo.com" },
|
||||
"default-src http://www.selfuri.com http://foo.com" },
|
||||
{ "default-src 'NONE'",
|
||||
"default-src 'none'" },
|
||||
{ "script-src policy-uri ",
|
||||
"script-src http://policy-uri" },
|
||||
{ "img-src 'self'; ",
|
||||
"img-src 'self'" },
|
||||
"img-src http://www.selfuri.com" },
|
||||
{ "frame-ancestors foo-bar.com",
|
||||
"frame-ancestors http://foo-bar.com" },
|
||||
{ "frame-ancestors http://a.com",
|
||||
"frame-ancestors http://a.com" },
|
||||
{ "frame-ancestors 'self'",
|
||||
"frame-ancestors 'self'" },
|
||||
"frame-ancestors http://www.selfuri.com" },
|
||||
{ "frame-ancestors http://self.com:88",
|
||||
"frame-ancestors http://self.com:88" },
|
||||
{ "frame-ancestors http://a.b.c.d.e.f.g.h.i.j.k.l.x.com",
|
||||
@@ -799,13 +799,13 @@ TEST(CSPParser, GoodGeneratedPolicies)
|
||||
{ "frame-ancestors http://sampleuser:samplepass@example.com",
|
||||
"frame-ancestors 'none'" },
|
||||
{ "default-src 'none'; frame-ancestors 'self'",
|
||||
"default-src 'none'; frame-ancestors 'self'" },
|
||||
"default-src 'none'; frame-ancestors http://www.selfuri.com" },
|
||||
{ "frame-ancestors http://self:80",
|
||||
"frame-ancestors http://self:80" },
|
||||
{ "frame-ancestors http://self.com/bar",
|
||||
"frame-ancestors http://self.com/bar" },
|
||||
{ "default-src 'self'; frame-ancestors 'self'",
|
||||
"default-src 'self'; frame-ancestors 'self'" },
|
||||
"default-src http://www.selfuri.com; frame-ancestors http://www.selfuri.com" },
|
||||
{ "frame-ancestors http://bar.com/foo.png",
|
||||
"frame-ancestors http://bar.com/foo.png" },
|
||||
};
|
||||
|
||||
@@ -1724,8 +1724,7 @@ WebSocketImpl::Init(JSContext* aCx,
|
||||
EmptyString(), // aScriptSample
|
||||
0, // aLineNumber
|
||||
0, // aColumnNumber
|
||||
nsIScriptError::warningFlag,
|
||||
NS_LITERAL_CSTRING("upgradeInsecureRequest"),
|
||||
nsIScriptError::warningFlag, "CSP",
|
||||
mInnerWindowID,
|
||||
mPrivateBrowsing);
|
||||
}
|
||||
|
||||
@@ -2930,8 +2930,7 @@ NS_ShouldSecureUpgrade(nsIURI* aURI,
|
||||
EmptyString(), // aScriptSample
|
||||
0, // aLineNumber
|
||||
0, // aColumnNumber
|
||||
nsIScriptError::warningFlag,
|
||||
NS_LITERAL_CSTRING("upgradeInsecureRequest"),
|
||||
nsIScriptError::warningFlag, "CSP",
|
||||
innerWindowId,
|
||||
!!aLoadInfo->GetOriginAttributes().mPrivateBrowsingId);
|
||||
Telemetry::AccumulateCategorical(Telemetry::LABELS_HTTP_SCHEME_UPGRADE_TYPE::CSP);
|
||||
|
||||
@@ -3974,22 +3974,20 @@ HttpChannelChild::ActorDestroy(ActorDestroyReason aWhy)
|
||||
}
|
||||
|
||||
mozilla::ipc::IPCResult
|
||||
HttpChannelChild::RecvLogBlockedCORSRequest(const nsString& aMessage,
|
||||
const nsCString& aCategory)
|
||||
HttpChannelChild::RecvLogBlockedCORSRequest(const nsString& aMessage)
|
||||
{
|
||||
Unused << LogBlockedCORSRequest(aMessage, aCategory);
|
||||
Unused << LogBlockedCORSRequest(aMessage);
|
||||
return IPC_OK();
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
HttpChannelChild::LogBlockedCORSRequest(const nsAString & aMessage,
|
||||
const nsACString& aCategory)
|
||||
HttpChannelChild::LogBlockedCORSRequest(const nsAString & aMessage)
|
||||
{
|
||||
if (mLoadInfo) {
|
||||
uint64_t innerWindowID = mLoadInfo->GetInnerWindowID();
|
||||
bool privateBrowsing = !!mLoadInfo->GetOriginAttributes().mPrivateBrowsingId;
|
||||
nsCORSListenerProxy::LogBlockedCORSRequest(innerWindowID, privateBrowsing,
|
||||
aMessage, aCategory);
|
||||
aMessage);
|
||||
}
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
@@ -191,8 +191,8 @@ protected:
|
||||
// Get event target for processing network events.
|
||||
already_AddRefed<nsIEventTarget> GetNeckoTarget() override;
|
||||
|
||||
virtual mozilla::ipc::IPCResult RecvLogBlockedCORSRequest(const nsString& aMessage, const nsCString& aCategory) override;
|
||||
NS_IMETHOD LogBlockedCORSRequest(const nsAString & aMessage, const nsACString& aCategory) override;
|
||||
virtual mozilla::ipc::IPCResult RecvLogBlockedCORSRequest(const nsString& aMessage) override;
|
||||
NS_IMETHOD LogBlockedCORSRequest(const nsAString & aMessage) override;
|
||||
|
||||
private:
|
||||
// this section is for main-thread-only object
|
||||
|
||||
@@ -2354,12 +2354,10 @@ HttpChannelParent::DoSendSetPriority(int16_t aValue)
|
||||
}
|
||||
|
||||
nsresult
|
||||
HttpChannelParent::LogBlockedCORSRequest(const nsAString& aMessage,
|
||||
const nsACString& aCategory)
|
||||
HttpChannelParent::LogBlockedCORSRequest(const nsAString& aMessage)
|
||||
{
|
||||
if (mIPCClosed ||
|
||||
NS_WARN_IF(!SendLogBlockedCORSRequest(nsString(aMessage),
|
||||
nsCString(aCategory)))) {
|
||||
NS_WARN_IF(!SendLogBlockedCORSRequest(nsString(aMessage)))) {
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
return NS_OK;
|
||||
|
||||
@@ -222,7 +222,7 @@ protected:
|
||||
MOZ_MUST_USE nsresult
|
||||
ReportSecurityMessage(const nsAString& aMessageTag,
|
||||
const nsAString& aMessageCategory) override;
|
||||
nsresult LogBlockedCORSRequest(const nsAString& aMessage, const nsACString& aCategory) override;
|
||||
nsresult LogBlockedCORSRequest(const nsAString& aMessage) override;
|
||||
|
||||
// Calls SendDeleteSelf and sets mIPCClosed to true because we should not
|
||||
// send any more messages after that. Bug 1274886
|
||||
|
||||
@@ -593,8 +593,7 @@ InterceptedHttpChannel::AsyncOpen2(nsIStreamListener* aListener)
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
InterceptedHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage,
|
||||
const nsACString& aCategory)
|
||||
InterceptedHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage)
|
||||
{
|
||||
// Synthetic responses should not trigger CORS blocking.
|
||||
return NS_ERROR_NOT_IMPLEMENTED;
|
||||
|
||||
@@ -168,7 +168,7 @@ public:
|
||||
AsyncOpen2(nsIStreamListener *aListener) override;
|
||||
|
||||
NS_IMETHOD
|
||||
LogBlockedCORSRequest(const nsAString & aMessage, const nsACString& aCategory) override;
|
||||
LogBlockedCORSRequest(const nsAString & aMessage) override;
|
||||
|
||||
NS_IMETHOD
|
||||
SetupFallbackChannel(const char * aFallbackKey) override;
|
||||
|
||||
@@ -906,8 +906,7 @@ NullHttpChannel::SetIsMainDocumentChannel(bool aValue)
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
NullHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage,
|
||||
const nsACString& aCategory)
|
||||
NullHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage)
|
||||
{
|
||||
return NS_ERROR_NOT_IMPLEMENTED;
|
||||
}
|
||||
|
||||
@@ -152,7 +152,7 @@ child:
|
||||
// When CORS blocks the request in the parent process, it doesn't have the
|
||||
// correct window ID, so send the message to the child for logging to the web
|
||||
// console.
|
||||
async LogBlockedCORSRequest(nsString message, nsCString category);
|
||||
async LogBlockedCORSRequest(nsString message);
|
||||
|
||||
async AttachStreamFilter(Endpoint<PStreamFilterParent> aEndpoint);
|
||||
|
||||
|
||||
@@ -86,11 +86,10 @@ LogBlockedRequest(nsIRequest* aRequest,
|
||||
}
|
||||
|
||||
nsAutoString msg(blockedMessage.get());
|
||||
nsDependentCString category(aProperty);
|
||||
|
||||
if (XRE_IsParentProcess()) {
|
||||
if (aCreatingChannel) {
|
||||
rv = aCreatingChannel->LogBlockedCORSRequest(msg, category);
|
||||
rv = aCreatingChannel->LogBlockedCORSRequest(msg);
|
||||
if (NS_SUCCEEDED(rv)) {
|
||||
return;
|
||||
}
|
||||
@@ -106,11 +105,10 @@ LogBlockedRequest(nsIRequest* aRequest,
|
||||
privateBrowsing = nsContentUtils::IsInPrivateBrowsing(loadGroup);
|
||||
}
|
||||
|
||||
// we are passing aProperty as the category so we can link to the
|
||||
// appropriate MDN docs depending on the specific error.
|
||||
// log message ourselves
|
||||
uint64_t innerWindowID = nsContentUtils::GetInnerWindowID(aRequest);
|
||||
nsCORSListenerProxy::LogBlockedCORSRequest(innerWindowID, privateBrowsing,
|
||||
msg, category);
|
||||
msg);
|
||||
}
|
||||
|
||||
//////////////////////////////////////////////////////////////////////////
|
||||
@@ -1580,8 +1578,7 @@ nsCORSListenerProxy::StartCORSPreflight(nsIChannel* aRequestChannel,
|
||||
void
|
||||
nsCORSListenerProxy::LogBlockedCORSRequest(uint64_t aInnerWindowID,
|
||||
bool aPrivateBrowsing,
|
||||
const nsAString& aMessage,
|
||||
const nsACString& aCategory)
|
||||
const nsAString& aMessage)
|
||||
{
|
||||
nsresult rv = NS_OK;
|
||||
|
||||
@@ -1608,18 +1605,17 @@ nsCORSListenerProxy::LogBlockedCORSRequest(uint64_t aInnerWindowID,
|
||||
0, // lineNumber
|
||||
0, // columnNumber
|
||||
nsIScriptError::warningFlag,
|
||||
aCategory,
|
||||
"CORS",
|
||||
aInnerWindowID);
|
||||
}
|
||||
else {
|
||||
nsCString category = PromiseFlatCString(aCategory);
|
||||
rv = scriptError->Init(aMessage,
|
||||
EmptyString(), // sourceName
|
||||
EmptyString(), // sourceLine
|
||||
0, // lineNumber
|
||||
0, // columnNumber
|
||||
nsIScriptError::warningFlag,
|
||||
category.get(),
|
||||
"CORS",
|
||||
aPrivateBrowsing);
|
||||
}
|
||||
if (NS_FAILED(rv)) {
|
||||
|
||||
@@ -76,8 +76,7 @@ public:
|
||||
// browser console if no valid inner window ID is found.
|
||||
static void LogBlockedCORSRequest(uint64_t aInnerWindowID,
|
||||
bool aPrivateBrowsing,
|
||||
const nsAString& aMessage,
|
||||
const nsACString& aCategory);
|
||||
const nsAString& aMessage);
|
||||
private:
|
||||
// Only HttpChannelParent can call RemoveFromCorsPreflightCache
|
||||
friend class mozilla::net::HttpChannelParent;
|
||||
|
||||
@@ -426,10 +426,10 @@ nsHttpChannel::AddSecurityMessage(const nsAString& aMessageTag,
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage, const nsACString& aCategory)
|
||||
nsHttpChannel::LogBlockedCORSRequest(const nsAString& aMessage)
|
||||
{
|
||||
if (mWarningReporter) {
|
||||
return mWarningReporter->LogBlockedCORSRequest(aMessage, aCategory);
|
||||
return mWarningReporter->LogBlockedCORSRequest(aMessage);
|
||||
}
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
|
||||
@@ -50,7 +50,7 @@ public:
|
||||
virtual MOZ_MUST_USE nsresult
|
||||
ReportSecurityMessage(const nsAString& aMessageTag,
|
||||
const nsAString& aMessageCategory) = 0;
|
||||
virtual nsresult LogBlockedCORSRequest(const nsAString& aMessage, const nsACString& aCategory) = 0;
|
||||
virtual nsresult LogBlockedCORSRequest(const nsAString& aMessage) = 0;
|
||||
};
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
@@ -190,7 +190,7 @@ public:
|
||||
MOZ_MUST_USE nsresult
|
||||
AddSecurityMessage(const nsAString& aMessageTag,
|
||||
const nsAString& aMessageCategory) override;
|
||||
NS_IMETHOD LogBlockedCORSRequest(const nsAString& aMessage, const nsACString& aCategory) override;
|
||||
NS_IMETHOD LogBlockedCORSRequest(const nsAString& aMessage) override;
|
||||
|
||||
void SetWarningReporter(HttpChannelSecurityWarningReporter *aReporter);
|
||||
HttpChannelSecurityWarningReporter* GetWarningReporter();
|
||||
|
||||
@@ -508,9 +508,6 @@ interface nsIHttpChannel : nsIChannel
|
||||
*
|
||||
* @param aMessage
|
||||
* The message to print in the console.
|
||||
*
|
||||
* @param aCategory
|
||||
* The category under which the message should be displayed.
|
||||
*/
|
||||
void logBlockedCORSRequest(in AString aMessage, in ACString aCategory);
|
||||
void logBlockedCORSRequest(in AString aMessage);
|
||||
};
|
||||
|
||||
@@ -1134,12 +1134,11 @@ nsViewSourceChannel::SetAltDataForChild(bool aIsForChild)
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsViewSourceChannel::LogBlockedCORSRequest(const nsAString& aMessage,
|
||||
const nsACString& aCategory)
|
||||
nsViewSourceChannel::LogBlockedCORSRequest(const nsAString& aMessage)
|
||||
{
|
||||
if (!mHttpChannel) {
|
||||
NS_WARNING("nsViewSourceChannel::LogBlockedCORSRequest mHttpChannel is null");
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
return mHttpChannel->LogBlockedCORSRequest(aMessage, aCategory);
|
||||
return mHttpChannel->LogBlockedCORSRequest(aMessage);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
[frame-src-redirect.html]
|
||||
expected: TIMEOUT
|
||||
[Redirected iframe src should evaluate both enforced and report-only policies on both original request and when following redirect]
|
||||
expected: TIMEOUT
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
[frame-src-self-unique-origin.html]
|
||||
expected: TIMEOUT
|
||||
[Iframe's url must not match with 'self'. It must be blocked.]
|
||||
expected: TIMEOUT
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
[img-src-self-unique-origin.html]
|
||||
expected: TIMEOUT
|
||||
[Image's url must not match with 'self'. Image must be blocked.]
|
||||
expected: TIMEOUT
|
||||
|
||||
@@ -42,9 +42,13 @@ async function testPolicy(customCSP = null) {
|
||||
}
|
||||
|
||||
|
||||
function filterSelf(sources) {
|
||||
return sources.map(src => src == "'self'" ? baseURL : src);
|
||||
}
|
||||
|
||||
function checkSource(name, policy, expected) {
|
||||
equal(JSON.stringify(policy[name].sort()),
|
||||
JSON.stringify(expected[name].sort()),
|
||||
JSON.stringify(filterSelf(expected[name]).sort()),
|
||||
`Expected value for ${name}`);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user