corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1473587 - CSP Violation events should have the correct sample for inline contexts, r=jorendorff, r=ckerschb

Browse Source
This commit is contained in:
Andrea Marchesini
2018-07-16 17:58:04 +02:00
parent e6b0fdd44c
commit ad099acfe2
18 changed files with 126 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
caps/nsScriptSecurityManager.cpp
View File

@@ -471,7 +471,8 @@ NS_IMPL_ISUPPORTS(nsScriptSecurityManager,
///////////////// Security Checks /////////////////
bool
nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx)
nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx,
JS::HandleValue aValue)
{
MOZ_ASSERT(cx == nsContentUtils::GetCurrentJSContext());
nsCOMPtr<nsIPrincipal> subjectPrincipal = nsContentUtils::SubjectPrincipal();
@@ -494,12 +495,22 @@ nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx)
}
if (reportViolation) {
JS::Rooted<JSString*> jsString(cx, JS::ToString(cx, aValue));
if (NS_WARN_IF(!jsString)) {
JS_ClearPendingException(cx);
return false;
}
nsAutoJSString scriptSample;
if (NS_WARN_IF(!scriptSample.init(cx, jsString))) {
JS_ClearPendingException(cx);
return false;
}
JS::AutoFilename scriptFilename;
nsAutoString fileName;
unsigned lineNum = 0;
unsigned columnNum = 0;
NS_NAMED_LITERAL_STRING(scriptSample, "call to eval() or related function blocked by CSP");
JS::AutoFilename scriptFilename;
if (JS::DescribeScriptedCaller(cx, &scriptFilename, &lineNum,
&columnNum)) {
if (const char *file = scriptFilename.get()) {