diff --git a/dom/security/test/csp/File b/dom/security/test/csp/File new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/dom/security/test/csp/file_xslt_inherits_csp.xml b/dom/security/test/csp/file_xslt_inherits_csp.xml new file mode 100644 index 000000000000..a6d99c308149 --- /dev/null +++ b/dom/security/test/csp/file_xslt_inherits_csp.xml @@ -0,0 +1,6 @@ + + + + + This is some Title + diff --git a/dom/security/test/csp/file_xslt_inherits_csp.xml^headers^ b/dom/security/test/csp/file_xslt_inherits_csp.xml^headers^ new file mode 100644 index 000000000000..635af0a4d9a8 --- /dev/null +++ b/dom/security/test/csp/file_xslt_inherits_csp.xml^headers^ @@ -0,0 +1,2 @@ +Content-Security-Policy: script-src 'self' +Cache-Control: no-cache diff --git a/dom/security/test/csp/file_xslt_inherits_csp.xsl b/dom/security/test/csp/file_xslt_inherits_csp.xsl new file mode 100644 index 000000000000..82a4b0ad978e --- /dev/null +++ b/dom/security/test/csp/file_xslt_inherits_csp.xsl @@ -0,0 +1,26 @@ + + + + + + + + <xsl:value-of select="$title"/> + + + + +

+ Below is some inline JavaScript generating some red text. +

+ +

+ + + link with lineOnClick + + + + diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini index 577c549b9594..d40a9363bccd 100644 --- a/dom/security/test/csp/mochitest.ini +++ b/dom/security/test/csp/mochitest.ini @@ -402,3 +402,8 @@ support-files = file_navigate_to.sjs file_navigate_to_request.html [test_independent_iframe_csp.html] +[test_xslt_inherits_csp.html] +support-files = + file_xslt_inherits_csp.xml + file_xslt_inherits_csp.xml^headers^ + file_xslt_inherits_csp.xsl diff --git a/dom/security/test/csp/test_xslt_inherits_csp.html b/dom/security/test/csp/test_xslt_inherits_csp.html new file mode 100644 index 000000000000..90e8372db1e6 --- /dev/null +++ b/dom/security/test/csp/test_xslt_inherits_csp.html @@ -0,0 +1,33 @@ + + + + + Bug 1597645: Make sure XSLT inherits the CSP r=ckerschb + + + + + + + + + + diff --git a/dom/xslt/base/txURIUtils.cpp b/dom/xslt/base/txURIUtils.cpp index fbb350bf61d7..adb6abb621ef 100644 --- a/dom/xslt/base/txURIUtils.cpp +++ b/dom/xslt/base/txURIUtils.cpp @@ -9,6 +9,7 @@ #include "nsIHttpChannelInternal.h" #include "nsIPrincipal.h" #include "mozilla/LoadInfo.h" +#include "mozilla/dom/nsCSPContext.h" using mozilla::dom::Document; using mozilla::net::LoadInfo; @@ -70,6 +71,13 @@ void URIUtils::ResetWithSource(Document* aNewDoc, nsINode* aSourceNode) { aNewDoc->SetPrincipals(sourcePrincipal, sourceStoragePrincipal); aNewDoc->SetBaseURI(sourceDoc->GetDocBaseURI()); + // Inherit the csp if there is one + nsCOMPtr csp = sourceDoc->GetCsp(); + if (csp) { + RefPtr cspToInherit = new nsCSPContext(); + cspToInherit->InitFromOther(static_cast(csp.get())); + aNewDoc->SetCsp(cspToInherit); + } // Copy charset aNewDoc->SetDocumentCharacterSetSource( sourceDoc->GetDocumentCharacterSetSource());