Bug 1958804: Add CSP to appPicker.xhtml r=tschuster,mossop

Differential Revision: https://phabricator.services.mozilla.com/D244837

dom/security/nsContentSecurityUtils.cpp

@@ -648,8 +648,10 @@ bool nsContentSecurityUtils::IsEvalAllowed(JSContext* cx,
 
   if (StaticPrefs::
           security_allow_unsafe_dangerous_privileged_evil_eval_AtStartup()) {
-    MOZ_LOG(sCSMLog, LogLevel::Debug,
-            ("Allowing eval() because security.allow_unsafe_dangerous_priviliged_evil_eval is enabled."));
+    MOZ_LOG(
+        sCSMLog, LogLevel::Debug,
+        ("Allowing eval() because "
+         "security.allow_unsafe_dangerous_priviliged_evil_eval is enabled."));
     return true;
   }
 
@@ -1967,7 +1969,6 @@ void nsContentSecurityUtils::AssertChromePageHasCSP(Document* aDocument) {
   static nsLiteralCString sAllowedChromePagesWithNoCSP[] = {
       "chrome://browser/content/shopping/review-checker.xhtml"_ns,
       "chrome://geckoview/content/geckoview.xhtml"_ns,
-      "chrome://global/content/appPicker.xhtml"_ns,
       // Test files
       "chrome://mochikit/"_ns,
       "chrome://mochitests/"_ns,

toolkit/components/apppicker/content/appPicker.js

@@ -74,6 +74,7 @@ AppPicker.prototype = {
     var fileList = mimeInfo.possibleLocalHandlers;
 
     var list = document.getElementById("app-picker-listbox");
+    list.addEventListener("dblclick", () => g_dialog.appDoubleClick());
 
     var primaryCount = 0;
 
@@ -228,3 +229,4 @@ AppPicker.prototype = {
 
 // Global object
 var g_dialog = new AppPicker();
+window.addEventListener("load", () => g_dialog.appPickerLoad());

toolkit/components/apppicker/content/appPicker.xhtml

@@ -4,12 +4,13 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
+<?csp default-src chrome: resource:; img-src chrome: moz-icon:; ?>
+
 <!DOCTYPE window>
 
 <window
   xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   xmlns:html="http://www.w3.org/1999/xhtml"
-  onload="g_dialog.appPickerLoad();"
   aria-describedby="content-description suggested-filename"
   persist="screenX screenY"
 >
@@ -42,10 +43,7 @@
       control="app-picker-listbox"
     />
 
-    <richlistbox
-      id="app-picker-listbox"
-      ondblclick="g_dialog.appDoubleClick();"
-    />
+    <richlistbox id="app-picker-listbox" />
 
     <label
       id="app-picker-notfound"