From 2a1682f2ee0d4506fa32e986f74ec3091ec09f21 Mon Sep 17 00:00:00 2001 From: Ben Kelly Date: Mon, 13 Feb 2017 12:15:58 -0500 Subject: [PATCH] Bug 1337543 P1 ServiceWorker should not inherit CSP from registration principal. r=baku --- dom/workers/ServiceWorkerPrivate.cpp | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/dom/workers/ServiceWorkerPrivate.cpp b/dom/workers/ServiceWorkerPrivate.cpp index 34e9e9565edb..a64f6e17fdf9 100644 --- a/dom/workers/ServiceWorkerPrivate.cpp +++ b/dom/workers/ServiceWorkerPrivate.cpp @@ -1743,23 +1743,23 @@ ServiceWorkerPrivate::SpawnWorkerIfNeeded(WakeUpReason aWhy, info.mStorageAllowed = access > nsContentUtils::StorageAccess::ePrivateBrowsing; info.mOriginAttributes = mInfo->GetOriginAttributes(); + // The ServiceWorkerRegistration principal should never have any CSP + // set. The CSP from the page that registered the SW should not be + // inherited. Verify this is the case in non-release builds +#if defined(DEBUG) || !defined(RELEASE_OR_BETA) nsCOMPtr csp; rv = info.mPrincipal->GetCsp(getter_AddRefs(csp)); if (NS_WARN_IF(NS_FAILED(rv))) { return rv; } - info.mCSP = csp; - if (info.mCSP) { - rv = info.mCSP->GetAllowsEval(&info.mReportCSPViolations, - &info.mEvalAllowed); - if (NS_WARN_IF(NS_FAILED(rv))) { - return rv; - } - } else { - info.mEvalAllowed = true; - info.mReportCSPViolations = false; - } + MOZ_DIAGNOSTIC_ASSERT(!csp); +#endif + + // Default CSP permissions for now. These will be overrided if necessary + // based on the script CSP headers during load in ScriptLoader. + info.mEvalAllowed = true; + info.mReportCSPViolations = false; WorkerPrivate::OverrideLoadInfoLoadGroup(info);