Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-01 00:32:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1415352: Part 5a - Allow extension codebase principals to override CSP. r=bz

Browse Source 
We currently use plain extension codebase principals for most of the extension
stylesheets that we inject into content pages. Since we want the content
loaded by those stylesheets to be exempt from CSP, and can't safely use
expanded principals for their loads, we need to make plain extension codebase
principals exempt from CSP.

MozReview-Commit-ID: IIAUWU68nor

--HG--
extra : rebase_source : f7447e1d87c8d75b97de580a641fcac6333a9f27
This commit is contained in:
Kris Maglione 2017-11-07 14:25:59 -08:00
parent 1653b08073
commit d81173fce7
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
caps/BasePrincipal.h
View File

@ -140,11 +140,21 @@ public:
/**
* Returns true if this principal's CSP should override a document's CSP for
* loads that it triggers. Currently true only for expanded principals which
* subsume the document principal.
* subsume the document principal, and add-on codebase principals regardless
* of whether they subsume the document principal.
*/
bool OverridesCSP(nsIPrincipal* aDocumentPrincipal)
{
return mKind == eExpandedPrincipal && FastSubsumes(aDocumentPrincipal);
// Expanded principals override CSP if and only if they subsume the document
// principal.
if (mKind == eExpandedPrincipal) {
return FastSubsumes(aDocumentPrincipal);
}
// Extension principals always override the CSP non-extension principals.
// This is primarily for the sake of their stylesheets, which are usually
// loaded from channels and cannot have expanded principals.
return (AddonPolicy() &&
!BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
}
protected: