Attachment #800031 for bug #607067

Attachment #800031: bug-607067.patch for bug #607067

View | Details | Raw Unified | Return to bug 607067
Collapse All | Expand All





 * Any copyright is dedicated to the Public Domain.
 * http://creativecommons.org/publicdomain/zero/1.0/
 *
 * ***** END LICENSE BLOCK ***** */

// Tests that the Web Console CSP messages are displayed

const TEST_VIOLATION = "https://example.com/browser/browser/devtools/webconsole/test/test_bug_770099_violation.html";
const CSP_VIOLATION_MSG = 'Content Security Policy: The page\'s settings blocked the loading of a resource at http://some.example.com/test.png ("default-src https://example.com:443").'

let hud = undefined;

function test() {
  addTab("data:text/html;charset=utf8,Web Console CSP violation test");
  browser.addEventListener("load", function _onLoad() {
    browser.removeEventListener("load", _onLoad, true);
    openConsole(null, loadDocument);





      // grab value tokens and interpret them
      var options = dirvalue.split(/\s+/);
      for each (var opt in options) {
        if (opt === "inline-script")
          aCSPR._allowInlineScripts = true;
        else if (opt === "eval-script")
          aCSPR._allowEval = true;
        else
          cspWarn(aCSPR, CSPLocalizer.getFormatStr("ignoringUnknownOption",
                                                   [opt]));
      }
      continue directive;
    }

    // ALLOW DIRECTIVE //////////////////////////////////////////////////
    // parse "allow" as equivalent to "default-src", at least until the spec
    // stabilizes, at which time we can stop parsing "allow"


          // Verify that each report URI is in the same etld + 1 and that the
          // scheme and port match "self" if "self" is defined, and just that
          // it's valid otherwise.
          if (self) {
            if (gETLDService.getBaseDomain(uri) !==
                gETLDService.getBaseDomain(selfUri)) {
              cspWarn(aCSPR,
                      CSPLocalizer.getFormatStr("reportURInotETLDPlus1",
                                                [gETLDService.getBaseDomain(uri)]));
              continue;
            }
            if (!uri.schemeIs(selfUri.scheme)) {
              cspWarn(aCSPR, CSPLocalizer.getFormatStr("reportURInotSameSchemeAsSelf",
                                                       [uri.asciiSpec]));
              continue;
            }
            if (uri.port && uri.port !== selfUri.port) {
              cspWarn(aCSPR, CSPLocalizer.getFormatStr("reportURInotSamePortAsSelf",
                                                       [uri.asciiSpec]));
              continue;
            }
          }
        } catch(e) {
          switch (e.result) {
            case Components.results.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS:
            case Components.results.NS_ERROR_HOST_IS_IP_ADDRESS:


          // Verify that each report URI is in the same etld + 1 and that the
          // scheme and port match "self" if "self" is defined, and just that
          // it's valid otherwise.
          if (self) {
            if (gETLDService.getBaseDomain(uri) !==
                gETLDService.getBaseDomain(selfUri)) {
              cspWarn(aCSPR, 
                      CSPLocalizer.getFormatStr("reportURInotETLDPlus1",
                                                [gETLDService.getBaseDomain(uri)]));
              continue;
            }
            if (!uri.schemeIs(selfUri.scheme)) {
              cspWarn(aCSPR,
                      CSPLocalizer.getFormatStr("reportURInotSameSchemeAsSelf",
                                                [uri.asciiSpec]));
              continue;
            }
            if (uri.port && uri.port !== selfUri.port) {
              cspWarn(aCSPR,
                      CSPLocalizer.getFormatStr("reportURInotSamePortAsSelf",
                                                [uri.asciiSpec]));
              continue;
            }
          }
        } catch(e) {
          switch (e.result) {
            case Components.results.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS:
            case Components.results.NS_ERROR_HOST_IS_IP_ADDRESS:





  logViolationDetails:
  function(aViolationType, aSourceFile, aScriptSample, aLineNum) {
    // allowsInlineScript and allowsEval both return true when report-only mode
    // is enabled, resulting in a call to this function. Therefore we need to
    // check that the policy was in fact violated before logging any violations
    switch (aViolationType) {
    case Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_INLINE_STYLE:
      if (!this._policy.allowsInlineStyles)
        this._asyncReportViolation('self', null, CSPLocalizer.getStr("inlineStyleBlocked"),
                                   'violated base restriction: Inline Stylesheets will not apply',
                                   aSourceFile, aScriptSample, aLineNum);
      break;
    case Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_INLINE_SCRIPT:
      if (!this._policy.allowsInlineScripts)
        this._asyncReportViolation('self', null, CSPLocalizer.getStr("inlineScriptBlocked"),
                                   'violated base restriction: Inline Scripts will not execute',
                                   aSourceFile, aScriptSample, aLineNum);
      break;
    case Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_EVAL:
      if (!this._policy.allowsEvalInScripts)
        this._asyncReportViolation('self', null, CSPLocalizer.getStr("scriptFromStringBlocked"),
                                   'violated base restriction: Code will not be created from strings',
                                   aSourceFile, aScriptSample, aLineNum);
      break;
    }
  },

  set reportOnlyMode(val) {
    this._reportOnlyMode = val;

      if (aLineNum)
        report["csp-report"]["line-number"] = aLineNum;

      var reportString = JSON.stringify(report);
      CSPdebug("Constructed violation report:\n" + reportString);

      var violationMessage = null;
      if (blockedUri["asciiSpec"]) {
         violationMessage = CSPLocalizer.getFormatStr("CSPViolationWithURI", [violatedDirective, blockedUri.asciiSpec]);
      } else {
         violationMessage = CSPLocalizer.getFormatStr("CSPViolation", [violatedDirective]);
      }
      this._policy.log(WARN_FLAG, violationMessage,
                        (aSourceFile) ? aSourceFile : null,
                        (aScriptSample) ? decodeURIComponent(aScriptSample) : null,
                        (aLineNum) ? aLineNum : null);

      // For each URI in the report list, send out a report.
      // We make the assumption that all of the URIs are absolute URIs; this





# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# CSP Warnings:
# LOCALIZATION NOTE (CSPViolation):
# %1$S is the reason why the resource has not been loaded.
CSPViolation = The page's settings blocked the loading of a resource: %1$S
# LOCALIZATION NOTE (CSPViolationWithURI):
# %1$S is the directive that has been violated.
# %2$S is the URI of the resource which violated the directive.
CSPViolationWithURI = The page's settings blocked the loading of a resource at %2$S ("%1$S").
# LOCALIZATION NOTE (triedToSendReport):
# %1$S is the URI we attempted to send a report to.
triedToSendReport = Tried to send report to invalid URI: "%1$S"
# LOCALIZATION NOTE (errorWas):
# %1$S is the error resulting from attempting to send the report
errorWas = error was: "%1$S"
# LOCALIZATION NOTE (couldNotParseReportURI):
# %1$S is the report URI that could not be parsed
couldNotParseReportURI = couldn't parse report URI: %1$S
# LOCALIZATION NOTE (couldNotProcessUnknownDirective):
# %1$S is the unknown directive
couldNotProcessUnknownDirective = Couldn't process unknown directive '%1$S'
# LOCALIZATION NOTE (ignoringUnknownOption):
# %1$S is the option that could not be understood
ignoringUnknownOption = Ignoring unknown option %1$S
# LOCALIZATION NOTE (reportURInotETLDPlus1):
# %1$S is the ETLD of the report URI that could not be used
reportURInotETLDPlus1 = The report URI (%1$S) must be from the same eTLD+1.
# LOCALIZATION NOTE (reportURInotSameSchemeAsSelf, reportURInotSamePortAsSelf):
# %1$S is the report URI that could not be used
reportURInotSameSchemeAsSelf = The report URI (%1$S) must use the same scheme as the originating document.
reportURInotSamePortAsSelf = The report URI (%1$S) must use the same port as the originating document.
# %1$S is the report URI that could not be used
notSamePort = can't use report URI with different port from originating document: %1$S
# LOCALIZATION NOTE (pageCannotSendReportsTo):
# %1$S is the URI of the page with the policy
# %2$S is the report URI that could not be used
pageCannotSendReportsTo = page on %1$S cannot send reports to %2$S
allowOrDefaultSrcRequired = 'allow' or 'default-src' directive required but not present.  Reverting to "default-src 'none'"
# LOCALIZATION NOTE (failedToParseUnrecognizedSource):
# %1$S is the CSP Source that could not be parsed
failedToParseUnrecognizedSource = Failed to parse unrecognized source %1$S
# LOCALIZATION NOTE (reportPostRedirect):
# %1$S is the specified report URI before redirect
reportPostRedirect = Post of violation report to %1$S failed, as a redirect occurred
# LOCALIZATION NOTE (allowDirectiveIsDeprecated):
# Don't translate "allow" and "default-src" as they are keywords and part of
# the CSP protocol syntax.
allowDirectiveIsDeprecated = allow directive is deprecated, use the equivalent default-src directive instead
# LOCALIZATION NOTE (inlineScriptBlocked):
# inline script refers to JavaScript code that is embedded into the HTML document.
inlineScriptBlocked = An attempt to execute inline scripts has been blocked
# LOCALIZATION NOTE (inlineStyleBlocked):
# inline style refers to CSS code that is embedded into the HTML document.
inlineStyleBlocked = An attempt to apply inline style sheets has been blocked
# LOCALIZATION NOTE (scriptFromStringBlocked):
# eval is a name and should not be localized.
scriptFromStringBlocked = An attempt to call JavaScript from a string (by calling a function like eval) has been blocked

# CSP Errors:
policyURINotAlone = policy-uri directive can only appear alone
noParentRequest = The policy-uri cannot be fetched without a parent request and a CSP.
# LOCALIZATION NOTE (policyURIParseError):
# %1$S is the URI that could not be parsed
policyURIParseError = could not parse URI in policy URI: %1$S
# LOCALIZATION NOTE (nonMatchingHost):

Return to bug 607067