Commit Graph

94 Commits

Author SHA1 Message Date
Tom Schuster
a60d06b5ef Bug 1525006 - Add a new internal ContentPolicyType for ES6 modules. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D19269

--HG--
extra : moz-landing-system : lando
2019-02-12 13:16:32 +00:00
Sylvestre Ledru
265e672179 Bug 1511181 - Reformat everything to the Google coding style r=ehsan a=clang-format
# ignore-this-changeset

--HG--
extra : amend_source : 4d301d3b0b8711c4692392aa76088ba7fd7d1022
2018-11-30 11:46:48 +01:00
Andrea Marchesini
dbb1bf7e31 Bug 1438945 - Part 6: CSP via IPC. r=ckerschb
--HG--
extra : rebase_source : 8ea27a931619ec0bf75035039c9b4d66d23d7e70
2018-11-19 15:18:21 -08:00
Henri Sivonen
0b01108591 Bug 1489098 - Remove useless use of PromiseFlatString. r=peterv
MozReview-Commit-ID: 10JE4PRp8i0

Differential Revision: https://phabricator.services.mozilla.com/D5237

--HG--
extra : moz-landing-system : lando
2018-09-11 17:17:05 +00:00
Mike Hommey
32627430f6 Bug 1489363 - Replace some string.Append* with AppendLiteral. r=froydnj
Depends on D5224

Differential Revision: https://phabricator.services.mozilla.com/D5225

--HG--
extra : moz-landing-system : lando
2018-09-07 22:12:04 +00:00
Christoph Kerschbaumer
49eaf535cb Bug 1474537 - CSP 'self' should translate to 'self' and not be resolved to actual self URI. r=dveditz 2018-07-22 18:08:17 +02:00
Christoph Kerschbaumer
adac33969a Bug 1304645: Pass individual CSP errors as categories to web console error messages. r=baku 2018-07-20 19:57:21 +02:00
Andreea Pavel
b5a482c899 Backed out 3 changesets (bug 1475073, bug 1304645, bug 1474537) for failing wpt and mochitest on a CLOSED TREE
Backed out changeset 4fbeea69b10d (bug 1475073)
Backed out changeset d3ac68d9ead9 (bug 1304645)
Backed out changeset 113b601a3b59 (bug 1474537)
2018-07-20 14:00:09 +03:00
Christoph Kerschbaumer
1de27c0297 Bug 1304645: Pass individual CSP errors as categories to web console error messages. r=baku 2018-07-20 10:42:46 +02:00
Christoph Kerschbaumer
f33c5faa8f Bug 1474537 - CSP 'self' should translate to 'self' and not be resolved to actual self URI. r=dveditz 2018-07-20 10:39:31 +02:00
Andrea Marchesini
6c9f589b45 Bug 1476589 - Fix a wrong use of a char16_t string in nsCSPUtils, r=ckerschb 2018-07-19 11:11:43 +02:00
Andrea Marchesini
9042bfbc94 Bug 1473218 - Implement report-sample support for CSP directives, r=ckerschb 2018-07-06 08:01:49 +02:00
Emilio Cobos Álvarez
fffb25b74f Bug 1465585: Switch from mozilla::Move to std::move. r=froydnj
This was done automatically replacing:

  s/mozilla::Move/std::move/
  s/ Move(/ std::move(/
  s/(Move(/(std::move(/

Removing the 'using mozilla::Move;' lines.

And then with a few manual fixups, see the bug for the split series..

MozReview-Commit-ID: Jxze3adipUh
2018-06-01 10:45:27 +02:00
Andrea Marchesini
b5118e1ddf Bug 1302449 - Remove the "referrer" directive in CSP, r=ckerschb 2018-05-09 13:15:08 +02:00
vinoth
ea1f6cdedb Bug 1439330 - Condition added to block eval if only strict-dynamic is present without unsafe-eval keyword. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D859
2018-05-07 14:59:51 -04:00
Jonathan Kingston
0d79353b7d Bug 1439425 - Ignore empty CSP directives. r=ckerschb
MozReview-Commit-ID: 67Ach2vCs8A

--HG--
rename : dom/security/test/csp/file_self_none_as_hostname_confusion.html => dom/security/test/csp/file_empty_directive.html
rename : dom/security/test/csp/file_self_none_as_hostname_confusion.html^headers^ => dom/security/test/csp/file_empty_directive.html^headers^
rename : dom/security/test/csp/test_self_none_as_hostname_confusion.html => dom/security/test/csp/test_empty_directive.html
extra : rebase_source : 1270d3d1aa8d53389e8708d29d2e363e52c02029
2018-03-06 18:48:26 -08:00
Dave Townsend
e2dffad4ac Bug 1448500: Add speculative request content policy type. r=bz, r=kmag
Adds a new TYPE_SPECULATIVE to nsIContentPolicy uses it as the type for
speculative connection channels from the IO service. I believe I've added it to
all the content policies in tree to make sure it behaves the same as TYPE_OTHER
used to.

The webextension test shows that the webextension proxy API sees speculative
lookups requested through the IO service.

MozReview-Commit-ID: DQ4Kq0xdUOD

--HG--
extra : rebase_source : d9460fdac118bc68f0db79749a16f181b580f2e7
2018-03-23 15:27:08 -07:00
Andrea Marchesini
5784769019 Bug 1443079 - nsScriptError.isFromPrivateWindow must match the correct value also in e10s mode, r=smaug 2018-03-13 06:40:38 +01:00
Chung-Sheng Fu
d1124b72c7 Bug 1418243 - Fix SecurityPolicyViolationEvent.violatedDirective. r=ckerschb
MozReview-Commit-ID: 8DQ7CI5exUL

--HG--
extra : rebase_source : 69181c5e5f61f6fee5224def74c54985c3b47dee
2018-01-16 22:59:00 +02:00
Andrea Marchesini
a1765c1a3c Bug 1430758 - No CSP directive for nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD, r=ckerschb 2018-01-16 15:03:02 +01:00
Andreea Pavel
77efdcf21a Backed out 2 changesets (bug 1418243) for failing mochitest at dom/security/test/csp/test_frame_ancestors_ro.html and mochitest devtools at devtools/client/webconsole/test/browser_webconsole_bug_1010953_cspro.js a=merge
Backed out changeset 5357dbb6df2b (bug 1418243)
Backed out changeset 778a37000696 (bug 1418243)
2018-01-16 13:02:32 +02:00
Chung-Sheng Fu
eaddf31393 Bug 1418243 - Fix SecurityPolicyViolationEvent.violatedDirective. r=ckerschb
MozReview-Commit-ID: 8DQ7CI5exUL
2018-01-15 23:30:00 +02:00
Christoph Kerschbaumer
2fd8493f7f Bug 1302667 - CSP: Implement 'worker-src'. r=baku,dveditz,mckinley 2017-10-30 18:45:36 +01:00
Coroiu Cristina
44d1b50592 Backed out changeset 70ccfda99dbc::ca6ae38c0432 (bug 1302667) for frequently failing mochitest in security/test/csp/test_worker_src.html r=backout a=backout on a CLOSED TREE
Backed out changeset ca6ae38c0432 (bug 1302667)
Backed out changeset ff86e185e09d (bug 1302667)
Backed out changeset 8ec6b8bf8c6c (bug 1302667)
Backed out changeset 21c73f9d8fac (bug 1302667)
Backed out changeset e982481dbf2c (bug 1302667)
Backed out changeset 70ccfda99dbc (bug 1302667)
2017-10-30 14:19:29 +02:00
Christoph Kerschbaumer
58b63c1576 Bug 1302667 - CSP: Implement 'worker-src'. r=baku,dveditz,mckinley 2017-10-30 09:10:36 +01:00
Nicholas Nethercote
159f6b5627 Bug 1406794 - Provide the CSP keywords in both UTF8 and UTF16 forms. r=ckerschb
This avoids the need for numerous 8-to-16-bit and 16-to-8-bit string
conversions.

The patch also introduces a higher-order macro, FOR_EACH_CSP_KEYWORD, which
defines all the stuff about the keywords in a single place and makes the code
nicer.

--HG--
extra : rebase_source : b0f655546aa397749bb18dc7d6d27fbc12fe8fca
2017-10-06 16:16:52 +11:00
Chris Peterson
5698729243 Bug 870698 - Part 10: Replace Append(NS_LITERAL_STRING("")) with AppendLiteral(u""). r=erahm
The NS_LITERAL_STRING macro creates a temporary nsLiteralString to encapsulate the char16_t string literal and its length, but AssignLiteral() can determine the char16_t string literal's length at compile-time without nsLiteralString.

MozReview-Commit-ID: H9I6vNDMdIr

--HG--
extra : rebase_source : cf537a1f65af003c6c4f8919b925b0f305c1dd4d
extra : source : 13b89ce4e6a66c840f82a335c71f5a12938aba22
2017-09-07 18:32:54 -07:00
Christoph Kerschbaumer
79a239cba5 Bug 1387684 - CSP: Special case 'self' for unique opaque origins. r=dveditz 2017-08-23 10:05:12 +02:00
Nicholas Nethercote
f941156987 Bug 1386600 - Change nsIStringBundle methods to return |AString| instead of |wstring|. r=emk,sr=dbaron.
This removes about 2/3 of the occurrences of nsXPIDLString in the tree. The
places where nsXPIDLStrings are null-checked are replaced with |rv| checks.

The patch also removes a couple of unused declarations from
nsIStringBundle.idl.

Note that nsStringBundle::GetStringFromNameHelper() was merged into
GetStringFromName(), because they both would have had the same signature.

--HG--
extra : rebase_source : ac40bc31c2a4997f2db0bd5069cc008757a2df6d
2017-08-04 14:40:52 +10:00
Nicholas Nethercote
c86dc10505 Bug 1380227 - Avoid many UTF16toUTF8 and UTF8toUTF16 conversions in nsStringBundle. r=emk.
Most of the names passed to nsIStringBundle::{Get,Format}StringFromUTF8Name
have one of the two following forms:

- a 16-bit C string literal, which is then converted to an 8-bit string in
  order for the lookup to occur;

- an 8-bit C string literal converted to a 16-bit string, which is then
  converted back to an 8-bit string in order for the lookup to occur.

This patch introduces and uses alternative methods that can take an 8-bit C
string literal, which requires changing some signatures in other methods and
functions. It replaces all C++ uses of the old methods.

The patch also changes the existing {Get,Format}StringFromName() methods so
they take an AUTF8String argument for the name instead of a wstring, because
that's nicer for JS code.

Even though there is a method for C++ code and a different one for JS code,
|binaryname| is used so that the existing method names can be used for the
common case in both languages.

The change reduces the number of NS_ConvertUTF8toUTF16 and
NS_ConvertUTF16toUTF8 conversions while running Speedometer v2 from ~270,000 to
~160,000. (Most of these conversions involved the string
"deprecatedReferrerDirective" in nsCSPParser.cpp.)

--HG--
extra : rebase_source : 3bee57a501035f76a81230d95186f8c3f460ff8e
2017-07-12 15:13:37 +10:00
Nicholas Nethercote
f1364a75ea Bug 1374580 (part 3) - Remove ns{,C}Substring typedefs. r=froydnj.
All the instances are converted as follows.

- nsSubstring  --> nsAString
- nsCSubstring --> nsACString

--HG--
extra : rebase_source : cfd2238c52e3cb4d13e3bd5ddb80ba6584ab6d91
2017-06-20 19:19:52 +10:00
Christoph Kerschbaumer
4956d67907 Bug 1367531: CSP should only check host (not including path) when performing frame ancestors checks. r=dveditz 2017-06-06 09:12:13 +02:00
Christoph Kerschbaumer
f18a8897be Bug 1345615: Allow websocket schemes when using 'self' in CSP. r=freddyb,dveditz 2017-04-27 09:59:16 +02:00
Cykesiopka
7c0b9e9d34 Bug 1356522 - Remove unnecessary nsICryptoHash output CRLF filtering in nsCSPUtils.cpp. r=ckerschb
This filtering is no longer necessary now that the fix for Bug 1338897 has landed and has gotten rid of the CRLF behaviour.

MozReview-Commit-ID: 9OKmrtQN3Cq

--HG--
extra : transplant_source : %C2%CD%AC%F6j%F5%D0%00%7E%AC%D2j%ACW%83%60%3B%F0%ED%CC
2017-04-17 17:34:18 +08:00
Frederik Braun
cef461241c Bug 1224225: Use GetAsciiHost in CSP source matching code r=ckerschb,KWierso
MozReview-Commit-ID: B7SwUEMiVwc

--HG--
extra : rebase_source : d5dbec9f6aac4a627c35fb93f85f8e922fa695dd
2017-03-15 13:22:06 +01:00
Tom Tromey
5f8f360823 Bug 1060419 - make log_print use Printf.h, r=froydnj
MozReview-Commit-ID: BIZ1GQEZ1vs

--HG--
extra : rebase_source : 2f1f0aa12493c44f352d9a7e8683e7bb72d2d75b
2016-12-15 20:16:31 -07:00
Ben Kelly
0e176007bb Bug 1322111 P1 Add TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS content policy type. r=ckerschb 2017-02-15 09:55:58 -05:00
Christoph Kerschbaumer
c267f70f91 Bug 1299483 - CSP: Implement 'strict-dynamic', enforcement changes. r=dveditz,freddyb 2016-11-08 12:55:23 +01:00
Christoph Kerschbaumer
f41283f981 Bug 1298680 - Use uint64_t consistently for windowID within CSP. r=freddyb 2016-09-19 12:57:20 +02:00
Christoph Kerschbaumer
9f2e941749 Bug 1296027 - CSP: Include 'Source' within error message when logging to the console. r=freddyb,bgrins 2016-09-19 10:18:55 +02:00
Henry Chang
f9eeeb2620 Bug 1229639 - Part 1: Match CSP host source with percent-decoded URI. r=ckerschb
MozReview-Commit-ID: CSGeoSR2qw8

--HG--
extra : rebase_source : f64cb0b9cab61ec09faa29139f72d28272fbbedb
2016-09-06 18:29:26 +08:00
Nicholas Nethercote
742fc7eb48 Bug 1297961 (part 1) - Introduce nsURI::GetSpecOrDefault(). r=hurley.
This function is an infallible alternative to nsIURI::GetSpec(). It's useful
when it's appropriate to handle a GetSpec() failure with a failure string, e.g.
for log/warning/error messages. It allows code like this:

  nsAutoCString spec;
  uri->GetSpec(spec);
  printf("uri: %s", spec.get());

to be changed to this:

  printf("uri: %s", uri->GetSpecOrDefault().get());

This introduces a slight behavioural change. Previously, if GetSpec() failed,
an empty string would be used here. Now, "[nsIURI::GetSpec failed]" will be
produced instead. In most cases this failure string will make for a clearer
log/warning/error message than the empty string.
* * *
Bug 1297961 (part 1b) - More GetSpecOrDefault() additions. r=hurley.

I will fold this into part 1 before landing.

--HG--
extra : rebase_source : ddc19a5624354ac098be019ca13cc24b99b80ddc
2016-08-26 16:02:31 +10:00
Christoph Kerschbaumer
df1432e805 Bug 1290560 - Update CSPParser to handle 'sandbox', 'require-sri' and 'report-uri' with no valid srcs correctly. r=dveditz 2016-08-19 18:41:45 +02:00
Christoph Kerschbaumer
3a9a5e2c83 Bug 1285003 - CSP: Insecure http port :80 should also allow secure https port :443. r=dveditz 2016-07-22 11:32:41 +02:00
Franziskus Kiefer
dd5231632f Bug 1263793 - Using content signature verifier for verifying remote newtab, r=keeler,mayhemer
MozReview-Commit-ID: ABXYYseKImq

--HG--
extra : rebase_source : 79614e5215e738dff9683ad447245bd830c887bf
2016-05-19 10:59:48 +02:00
Wes Kocher
e2d9911273 Backed out changeset 21d8bb5af7b4 (bug 1263793) for leaks in various jobs CLOSED TREE 2016-07-20 11:16:37 -07:00
Franziskus Kiefer
9b9c643025 Bug 1263793 - Using content signature verifier for verifying remote newtab, r=keeler,mayhemer
MozReview-Commit-ID: CHUPgBr8WaC

--HG--
extra : rebase_source : 969bd058a157c7307b7a4d3c2a4c5d62e82b7489
2016-05-19 10:59:48 +02:00
Thomas Nguyen
6516ad9dae Bug 959388 - Deliver CSP from HTTP header. r=ckerschb, r=khuey
MozReview-Commit-ID: 13ndERn6rrL

--HG--
extra : rebase_source : e0ec31f9d322b1385994eb7d66bd885c91d75df3
2016-06-30 12:31:59 +08:00
Paul Roberts
ec18fc5ff7 Bug 671389 - Implement CSP sandbox directive. r=ckerschb r=smaug
--HG--
extra : rebase_source : d9c5f5868c2558a3696cd489674da6f243be11ad
2016-06-29 07:48:44 -07:00
Christoph Kerschbaumer
25f6f710d7 Bug 1100181 - CSP: Enforce connect-src when submitting pings. r=arroway 2016-06-24 15:25:11 +02:00