Attachment 716141 Details for Bug 752559

[patch] Initial patch to introduce the console warning

bug_patch (text/plain), 2.57 KB, created by Vicențiu Ciorbaru

(hide)

Description:

Filename:

MIME Type:

Creator: Vicențiu Ciorbaru

Size: 2.57 KB

patch

obsolete

>diff -r 5e137a87e84f content/base/src/nsDocument.cpp
>--- a/content/base/src/nsDocument.cpp	Sun Feb 17 19:28:29 2013 +1100
>+++ b/content/base/src/nsDocument.cpp	Wed Feb 20 23:15:36 2013 +0200
>@@ -2287,6 +2287,20 @@
>   if (docShell) {
>     nsresult rv = docShell->GetSandboxFlags(&mSandboxFlags);
>     NS_ENSURE_SUCCESS(rv, rv);
>+    if (mSandboxFlags & SANDBOXED_NAVIGATION &&
>+        !(mSandboxFlags & SANDBOXED_SCRIPTS) &&
>+        !(mSandboxFlags & SANDBOXED_ORIGIN)) {
>+      // If the document is part of a sandbox, and the allow-scripts and 
>+      // allow-same-origin flags are set, the origin must be checked, and
>+      // if it is the same, a warning is printed to the console.
>+      nsresult rv = nsContentUtils::CheckSameOrigin(this, mParentDocument);
>+      if (NS_SUCCEEDED(rv)) {
>+        nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
>+                                        "DOM Events", this,
>+                                        nsContentUtils::eDOM_PROPERTIES,
>+                                        "BothAllowScriptsAndOriginPresent");
>+      }
>+    }
>   }
> 
>   nsresult rv = InitCSP(aChannel);
>diff -r 5e137a87e84f dom/locales/en-US/chrome/dom/dom.properties
>--- a/dom/locales/en-US/chrome/dom/dom.properties	Sun Feb 17 19:28:29 2013 +1100
>+++ b/dom/locales/en-US/chrome/dom/dom.properties	Wed Feb 20 23:15:36 2013 +0200
>@@ -131,4 +131,6 @@
> # LOCALIZATION NOTE: Do not translate "X-Content-Security-Policy", "X-Content-Security-Policy-Report-Only",  "Content-Security-Policy" or "Content-Security-Policy-Report-Only"
> OldCSPHeaderDeprecated=The X-Content-Security-Policy and X-Content-Security-Report-Only headers will be deprecated in the future. Please use the Content-Security-Policy and Content-Security-Report-Only headers with CSP spec compliant syntax instead.
> # LOCALIZATION NOTE: Do not translate "X-Content-Security-Policy/Report-Only" or "Content-Security-Policy/Report-Only"
>-BothCSPHeadersPresent=This site specified both an X-Content-Security-Policy/Report-Only header and a Content-Security-Policy/Report-Only header. The X-Content-Security-Policy/Report-Only header(s) will be ignored.
>\ No newline at end of file
>+BothCSPHeadersPresent=This site specified both an X-Content-Security-Policy/Report-Only header and a Content-Security-Policy/Report-Only header. The X-Content-Security-Policy/Report-Only header(s) will be ignored.
>+# LOCALIZATION NOTE: Do not translate "allow-scripts" or "allow-same-origin" or "sandbox" or "iframe"
>+BothAllowScriptsAndOriginPresent=Warning: Using both allow-scripts and allow-same-origin invalidates the iframe sandbox attribute.

Flags:

imelven: feedback+

Actions: View | Diff | Review

Attachments on bug 752559: 716141 | 717622 | 8362379 | 8369313 | 8373139 | 8407332 | 8407333 | 8407335 | 8420794 | 8428613 | 8440568 | 8444243 | 8446970 | 8451448 | 8459408 | 8466833 | 8485607