mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-27 14:52:16 +00:00
da762ea8c3
Updated Content Security Policy reporting to align with current W3C reporting standards. Reporting now supports the usage of the report-to directive, which utilizes a client's response header field to determine where a report should be sent upon a content security policy violation occurring. Unlike the previous report-uri directive, which parsed endpoint URIs directly from the response header, report-to utilizes endpoint groups to store the URIs that will receive the report. This patch handles the reception of a CSP violation, creation of a report from said violation, and report delivery, while the parsing of the endpoint URIs are handled by D193461. While the deprecated report-uri directive remains supported, it is now only used for reporting if a client does not specify a report- to header. Differential Revision: https://phabricator.services.mozilla.com/D197480
44 lines
1.3 KiB
Plaintext
44 lines
1.3 KiB
Plaintext
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
|
* You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
/**
|
|
* Dictionary used to display CSP info.
|
|
*/
|
|
|
|
dictionary CSP {
|
|
boolean report-only = false;
|
|
|
|
sequence<DOMString> default-src;
|
|
sequence<DOMString> script-src;
|
|
sequence<DOMString> object-src;
|
|
sequence<DOMString> style-src;
|
|
sequence<DOMString> img-src;
|
|
sequence<DOMString> media-src;
|
|
sequence<DOMString> frame-src;
|
|
sequence<DOMString> font-src;
|
|
sequence<DOMString> connect-src;
|
|
sequence<DOMString> report-uri;
|
|
sequence<DOMString> frame-ancestors;
|
|
// sequence<DOMString> reflected-xss; // not supported in Firefox
|
|
sequence<DOMString> base-uri;
|
|
sequence<DOMString> form-action;
|
|
sequence<DOMString> referrer;
|
|
sequence<DOMString> manifest-src;
|
|
sequence<DOMString> upgrade-insecure-requests;
|
|
sequence<DOMString> child-src;
|
|
sequence<DOMString> block-all-mixed-content;
|
|
sequence<DOMString> sandbox;
|
|
sequence<DOMString> worker-src;
|
|
sequence<DOMString> script-src-elem;
|
|
sequence<DOMString> script-src-attr;
|
|
sequence<DOMString> require-trusted-types-for;
|
|
sequence<DOMString> trusted-types;
|
|
sequence<DOMString> report-to;
|
|
};
|
|
|
|
[GenerateToJSON]
|
|
dictionary CSPPolicies {
|
|
sequence<CSP> csp-policies;
|
|
};
|