Commit Graph

69 Commits

Author SHA1 Message Date
Sylvestre Ledru
cec75ca74a Bug 1498586 - Add clang-format off to avoid the reformatting of the data structures r=Ehsan
Too hard/impossible for the tool to format correctly these structs

Differential Revision: https://phabricator.services.mozilla.com/D8569
2018-10-12 20:48:24 +00:00
Mike Hommey
70e384723c Bug 1489363 - Replace some string.Append* with AppendLiteral. r=froydnj
Depends on D5224

Differential Revision: https://phabricator.services.mozilla.com/D5225
2018-09-07 22:12:04 +00:00
Nicholas Nethercote
3fd11042ce Bug 1476820 - Convert some VarCache prefs in dom/security/ to use StaticPrefs. r=ckerschb
Specifically:
- "security.csp.enable"
- "security.csp.experimentalEnabled"
- "security.csp.enableStrictDynamic"
- "security.csp.reporting.script-sample.max-length"
- "security.csp.enable_violation_events"

MozReview-Commit-ID: G1ie4ut9QaK
2018-07-19 10:43:29 +10:00
Andrea Marchesini
6f2b5f4e88 Bug 1473218 - Implement report-sample support for CSP directives, r=ckerschb 2018-07-06 08:01:49 +02:00
Andrea Marchesini
bb748f8fe9 Bug 1302449 - Remove the "referrer" directive in CSP, r=ckerschb 2018-05-09 13:15:08 +02:00
Christoph Kerschbaumer
0b5b313094 Bug 1458504 - Move Tokenizer into it's own file so it can be shared by the CSP Parser and the Feature Policy Parser. r=jkt 2018-05-02 16:36:51 +02:00
Jonathan Kingston
d1b9a68518 Bug 1439425 - Ignore empty CSP directives. r=ckerschb
MozReview-Commit-ID: 67Ach2vCs8A
2018-03-06 18:48:26 -08:00
Christoph Kerschbaumer
b7b8c74bfd Bug 1302667 - CSP: Implement 'worker-src'. r=baku,dveditz,mckinley 2017-10-30 18:45:36 +01:00
Coroiu Cristina
5e682e8ded Backed out changeset 70ccfda99dbc::ca6ae38c0432 (bug 1302667) for frequently failing mochitest in security/test/csp/test_worker_src.html r=backout a=backout on a CLOSED TREE
Backed out changeset ca6ae38c0432 (bug 1302667)
Backed out changeset ff86e185e09d (bug 1302667)
Backed out changeset 8ec6b8bf8c6c (bug 1302667)
Backed out changeset 21c73f9d8fac (bug 1302667)
Backed out changeset e982481dbf2c (bug 1302667)
Backed out changeset 70ccfda99dbc (bug 1302667)
2017-10-30 14:19:29 +02:00
Christoph Kerschbaumer
2f5403999d Bug 1302667 - CSP: Implement 'worker-src'. r=baku,dveditz,mckinley 2017-10-30 09:10:36 +01:00
Nicholas Nethercote
2fed11c50c Bug 1406794 - Provide the CSP keywords in both UTF8 and UTF16 forms. r=ckerschb
This avoids the need for numerous 8-to-16-bit and 16-to-8-bit string
conversions.

The patch also introduces a higher-order macro, FOR_EACH_CSP_KEYWORD, which
defines all the stuff about the keywords in a single place and makes the code
nicer.
2017-10-06 16:16:52 +11:00
Kartikaya Gupta
14424677af Bug 1384233 - Remove SizePrintfMacros.h. r=froydnj
We have a minimum requirement of VS 2015 for Windows builds, which supports
the z length modifier for format specifiers. So we don't need SizePrintfMacros.h
any more, and can just use %zu and friends directly everywhere.

MozReview-Commit-ID: 6s78RvPFMzv
2017-07-26 16:03:57 -04:00
Nicholas Nethercote
8b5bdf0867 Bug 1380227 - Avoid many UTF16toUTF8 and UTF8toUTF16 conversions in nsStringBundle. r=emk.
Most of the names passed to nsIStringBundle::{Get,Format}StringFromUTF8Name
have one of the two following forms:

- a 16-bit C string literal, which is then converted to an 8-bit string in
  order for the lookup to occur;

- an 8-bit C string literal converted to a 16-bit string, which is then
  converted back to an 8-bit string in order for the lookup to occur.

This patch introduces and uses alternative methods that can take an 8-bit C
string literal, which requires changing some signatures in other methods and
functions. It replaces all C++ uses of the old methods.

The patch also changes the existing {Get,Format}StringFromName() methods so
they take an AUTF8String argument for the name instead of a wstring, because
that's nicer for JS code.

Even though there is a method for C++ code and a different one for JS code,
|binaryname| is used so that the existing method names can be used for the
common case in both languages.

The change reduces the number of NS_ConvertUTF8toUTF16 and
NS_ConvertUTF16toUTF8 conversions while running Speedometer v2 from ~270,000 to
~160,000. (Most of these conversions involved the string
"deprecatedReferrerDirective" in nsCSPParser.cpp.)
2017-07-12 15:13:37 +10:00
Sylvestre Ledru
9d4a84d778 Bug 1378712 - Remove all trailing whitespaces r=Ehsan
MozReview-Commit-ID: Kdz2xtTF9EG
2017-07-06 14:00:35 +02:00
Christoph Kerschbaumer
2745d9c1d7 Bug 1367531: CSP should only check host (not including path) when performing frame ancestors checks. r=dveditz 2017-06-06 09:12:13 +02:00
Christoph Kerschbaumer
887f413b99 Bug 1345615: Allow websocket schemes when using 'self' in CSP. r=freddyb,dveditz 2017-04-27 09:59:16 +02:00
David Major
7c0497b430 Bug 1344629 - Part 6: Rewrite unnecessary uses of nsLiteralString. r=dbaron
There's an antipattern where nsLiteralString is used as an unnecessary intermediary in converting from CharT* to CharT*,
e.g. CallAFunctionThatTakesACharPointer(NS_LITERAL_CSTRING("foo").get());
or
NS_NAMED_LITERAL_STRING(foo, "abc");
CallAFunctionThatTakesACharPointer(foo.get());

This patch rewrites the callsites that can be trivially changed to use char*/char16_t*.

I'd somewhat like to remove nsTLiteralString::get() altogether, but in code that's less straightforward than these examples, get() is useful enough to keep.

MozReview-Commit-ID: Kh1rUziVllo
2017-03-14 15:26:27 +13:00
Iris Hsiao
22d2818760 Backed out 12 changesets (bug 1344629) for stylo build bustage
Backed out changeset cf4273d3ac30 (bug 1344629)
Backed out changeset a96390e044e0 (bug 1344629)
Backed out changeset d9b330f9bc24 (bug 1344629)
Backed out changeset 2b460fe020af (bug 1344629)
Backed out changeset 0ada91b0452e (bug 1344629)
Backed out changeset 083304fcd6bd (bug 1344629)
Backed out changeset 53d7d1ce2c97 (bug 1344629)
Backed out changeset 55eee7078ae4 (bug 1344629)
Backed out changeset 7d3c06b3eca9 (bug 1344629)
Backed out changeset e5df14c3db61 (bug 1344629)
Backed out changeset 636095ff2815 (bug 1344629)
Backed out changeset 0be052ad24c1 (bug 1344629)
2017-03-14 11:52:24 +08:00
David Major
a660713d2b Bug 1344629 - Part 6: Rewrite unnecessary uses of nsLiteralString. r=dbaron
There's an antipattern where nsLiteralString is used as an unnecessary intermediary in converting from CharT* to CharT*,
e.g. CallAFunctionThatTakesACharPointer(NS_LITERAL_CSTRING("foo").get());
or
NS_NAMED_LITERAL_STRING(foo, "abc");
CallAFunctionThatTakesACharPointer(foo.get());

This patch rewrites the callsites that can be trivially changed to use char*/char16_t*.

I'd somewhat like to remove nsTLiteralString::get() altogether, but in code that's less straightforward than these examples, get() is useful enough to keep.

MozReview-Commit-ID: Kh1rUziVllo
2017-03-14 15:26:27 +13:00
Tom Tromey
a4b717ab39 Bug 1060419 - make log_print use Printf.h, r=froydnj
MozReview-Commit-ID: BIZ1GQEZ1vs
2016-12-15 20:16:31 -07:00
Ehsan Akhgari
0a15e53054 Bug 1331838 - Remove support for app URIs in CSP directives; r=ckerschb 2017-01-18 15:18:29 -05:00
Sebastian Hengst
bf9370011d Backed out changeset 8acb67f2e136 (bug 1331838) for failing GTest CSPParser.SimplePolicies. r=backout on a CLOSED TREE 2017-01-18 17:28:03 +01:00
Ehsan Akhgari
c7d59fd1dd Bug 1331838 - Remove support for app URIs in CSP directives; r=ckerschb 2017-01-18 08:57:13 -05:00
Tuhina
98e14ea94c Bug 1303685: Add telemetry for CSP referrer directive. r=ckerschb,francois 2016-11-04 21:36:25 +05:30
Thomas Wisniewski
d6055ab307 Bug 1324542 - Code-quality tweaks for isValidBase64Value. r=ckerschb 2016-12-20 11:56:14 -05:00
Thomas Wisniewski
257622862c Bug 1309219 - Only allow valid base64-values for CSP nonce and hash sources, per spec. r=francois 2016-11-24 21:46:09 -05:00
Christoph Kerschbaumer
9f60564f7a Bug 1299483 - CSP: Implement 'strict-dynamic', parser changes. r=dveditz,freddyb 2016-11-08 13:08:33 +01:00
Samriddhi Jain
fcb5725487 Bug 1303682 - Add deprecation warning before removing 'referrer' directive from CSP. r=ckerschb 2016-09-28 20:17:18 +05:30
Henry Chang
9de6b51965 Bug 1229639 - Part 1: Match CSP host source with percent-decoded URI. r=ckerschb
MozReview-Commit-ID: CSGeoSR2qw8
2016-09-06 18:29:26 +08:00
Nicholas Nethercote
62b6b0fce6 Bug 1297961 (part 1) - Introduce nsURI::GetSpecOrDefault(). r=hurley.
This function is an infallible alternative to nsIURI::GetSpec(). It's useful
when it's appropriate to handle a GetSpec() failure with a failure string, e.g.
for log/warning/error messages. It allows code like this:

  nsAutoCString spec;
  uri->GetSpec(spec);
  printf("uri: %s", spec.get());

to be changed to this:

  printf("uri: %s", uri->GetSpecOrDefault().get());

This introduces a slight behavioural change. Previously, if GetSpec() failed,
an empty string would be used here. Now, "[nsIURI::GetSpec failed]" will be
produced instead. In most cases this failure string will make for a clearer
log/warning/error message than the empty string.
* * *
Bug 1297961 (part 1b) - More GetSpecOrDefault() additions. r=hurley.

I will fold this into part 1 before landing.
2016-08-26 16:02:31 +10:00
Christoph Kerschbaumer
eb6c42f579 Bug 1290560 - Update CSPParser to handle 'sandbox', 'require-sri' and 'report-uri' with no valid srcs correctly. r=dveditz 2016-08-19 18:41:45 +02:00
Christoph Kerschbaumer
c688b69533 Bug 1289085: CSP - Bail early if referrer directive has no valid src. r=dveditz 2016-07-31 07:57:22 +02:00
Chris Peterson
6c0f810682 Bug 1277106 - Part 2: Expand MOZ_UTF16() strings to u"" string literals. r=Waldo 2016-07-20 22:03:25 -07:00
Paul Roberts
2108c2d0b5 Bug 671389 - Implement CSP sandbox directive. r=ckerschb r=smaug 2016-06-29 07:48:44 -07:00
Jonathan Kingston
63bd8e3e1e Bug 1279420 - Adding in security.csp.experimentalEnabled pref check to require-sri-for directive in CSP. r=ckerschb
MozReview-Commit-ID: 799ZZoW0YiG
2016-06-20 19:49:38 +01:00
Frederik Braun
7ff2c832e6 Bug 1265318: add require-sri-for CSP directive. r=ckerschb
MozReview-Commit-ID: 200PAvKtBME
2016-05-31 11:14:00 +02:00
Christoph Kerschbaumer
ee413feb5c Bug 1261634 - Update whitespace skipping for meta csp. r=dveditz 2016-04-21 21:15:06 +02:00
Aryeh Gregor
1c3d681cd3 Bug 1193762 part 8 - Fix things that will break; r=froydnj
It looks like VC++ doesn't like comparisons of nsCOMPtr to 0 after this
change, but those are bad style anyway, so I removed them from
TestCOMPtr.cpp instead of trying to make them work.
2016-05-01 21:29:23 +03:00
Franziskus Kiefer
3fb93d6cf2 Bug 1252829 - CSP Telemetry. r=ckerschb, p=bsmedberg
MozReview-Commit-ID: CiNAxh2ZrHB
2016-03-02 13:00:09 +01:00
Christoph Kerschbaumer
c2e478fafa Bug 1122236 - CSP: Implement block-all-mixed-content (r=tanvi,kate,mrbkap) 2016-01-13 20:58:16 -08:00
Christoph Kerschbaumer
d931fdbede Bug 1227813 - CSP: Ignore unsafe-inline within style-src if hash or nonce specified. r=kmckinley 2016-03-11 15:35:39 -08:00
Bogdan Postelnicu
e477013739 Bug 1228497 - initialize 3 members in class. r=christophkerschbaumer 2015-12-10 00:33:00 +01:00
sajitk
e7c3cfa4d5 Bug 1219478: Replace PRLogModuleInfo usage with LazyLogModule in dom folders except media.r=amerchesini 2015-11-23 11:09:25 -08:00
Christoph Kerschbaumer
a34c4d50c7 Bug 663570 - MetaCSP Part 1: CSP parser changes (r=sicking) 2015-11-14 19:27:59 -08:00
Christoph Kerschbaumer
3ecf758962 Bug 1188028 - Queue up CSP console messages till windowID is available (r=sicking) 2015-11-11 06:23:57 -08:00
Kate McKinley
37dd55761c Bug 1045891 - CSP 2 child-src implementation r=ckerschb 2015-10-28 16:32:27 -07:00
Makoto Kato
4c1c9e2ebc Bug 1218315 - Replace NS_LITERAL_STRING(...).get() with MOZ_UTF16(...) on dom. r=nfroyd 2015-10-28 14:29:57 +09:00
Christoph Kerschbaumer
45191c3ae4 Bug 1139297 - Implement CSP upgrade-insecure-requests directive - csp changes (r=sstamm) 2015-07-10 09:13:54 -07:00
Eric Rahm
900b3ebc4d Bug 1165515 - Part 13-2: Replace usage of PRLogModuleLevel and PR_LOG_*. rs=froydnj
This is straightforward mapping of PR_LOG levels to their LogLevel
counterparts:
  PR_LOG_ERROR   -> LogLevel::Error
  PR_LOG_WARNING -> LogLevel::Warning
  PR_LOG_WARN    -> LogLevel::Warning
  PR_LOG_INFO    -> LogLevel::Info
  PR_LOG_DEBUG   -> LogLevel::Debug
  PR_LOG_NOTICE  -> LogLevel::Debug
  PR_LOG_VERBOSE -> LogLevel::Verbose

Instances of PRLogModuleLevel were mapped to a fully qualified
mozilla::LogLevel, instances of PR_LOG levels in #defines were mapped to a
fully qualified mozilla::LogLevel::* level, and all other instances were
mapped to us a shorter format of LogLevel::*.

Bustage for usage of the non-fully qualified LogLevel were fixed by adding
|using mozilla::LogLevel;| where appropriate.
2015-06-03 15:25:57 -07:00
Eric Rahm
ab32c89747 Bug 1165515 - Part 3: Convert PR_LOG_TEST to MOZ_LOG_TEST. r=froydnj 2015-06-03 15:22:28 -07:00