upstream/UXP-mirror
2
0 Fork 1
mirror of https://github.com/Basilisk-Development-Team/UXP-mirror.git synced 2026-11-07 10:22:33 -05:00
Code Releases Activity
8,524 Commits 59 Branches 285 Tags
currentScript-work
Commit Graph
82 Commits
Author SHA1 Message Date
Moonchild 1462612e3c Issue #2914 - Explicitly allow mixed content websockets on localhost. 
This carves out an exception for hard-coded loopback addresses to allow
`ws:` connections from `https:` to allow mixed-mode from secure pages.

Resolves #2914
 2026-01-23 23:09:58 +01:00
Moonchild 3a6d7f624f No issue - Adjust CSP URI reporting more closely with the spec. 
According to the W3C discussion we should allow websocket URIs to be
reported aside from http/https/ftp ones.
This rewrites things slightly and updates comments to clarify.
We do retain the non-standard reduction to origin only in case the
report is for cross-origin URIs (stops leaking full URIs to the CSP
reported destination).
See https://github.com/w3c/webappsec-csp/issues/735
 2025-07-23 07:40:45 +02:00
Moonchild 69410b84e1 Issue #2734 - Add base-64 grammar check to CSP nonces where applicable. 
Resolves #2734
 2025-06-16 13:19:51 +02:00
Moonchild 189d73bbc2 Issue #2736 - Part 13: Override page CSP for loads by expanded principals. 
Per the CSP specification, content injected by extensions is meant to
be exempt from page CSP. This patch takes care of the most common case
of content injected by extension content scripts, which always have
expanded principals which inherit from the page principal.

To make this easier, de-virtualize BasePrincipal::Kind(), using CTOR
initializers instead.
 2025-05-09 23:08:54 +02:00
Moonchild ace69a4d32 Issue #2736 - Part 1: Provide more consistent principals to CSP. 
We're currently fairly vague and inconsistent about the values we provide to
content policy implementations for requestOrigin and requestPrincipal. In some
cases they're the triggering principal, sometimes the loading principal,
sometimes the channel principal.

Our existing content policy implementations which require or expect a
loading principal currently retrieve it from the context node.
Since no current callers require the principal to be the loading
principal, and some already expect it to be the triggering principal
(which there's currently no other way to retrieve), a choice was made
to pass the triggering principal whenever possible, but use the loading
principal to determine the origin URL.
 2025-04-26 20:07:16 +02:00
Moonchild 52f31a682d Issue #2728 - Remove obsolete CSP referrer policy. 
This has been superseded by the dedicated Referrer-policy header.
Resolves #2728
 2025-04-24 14:27:39 +02:00
Moonchild d2469da717 Merge remote-tracking branch 'Shadow/bug-1338304' 2025-03-11 13:15:49 +01:00
Shadow 857bb3cebf Explicitly use javascript: instead of URI_INHERITS_SECURITY_CONTEXT within subjectToCSP() (#2696) 
Bug 1330035

Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/2696
Co-authored-by: Shadow <shadow@no-reply.palemoon.org>
Co-committed-by: Shadow <shadow@no-reply.palemoon.org>
 2025-03-10 22:02:20 +00:00
Shadow 6f4994c4bc No Issue - Make nsCSPService cancel the channel if a redirect is blocked by CSP 
Bug 1338304
 2025-03-07 15:53:05 +00:00
Moonchild 6592cdfb42 [DOM] Honor security.csp.reporting.enabled pref in more places. 2025-02-18 09:59:26 +01:00
Moonchild add1037bb8 Issue #2542 - Part 7: Move SecFetch.* to /netwerk where it belongs. 2024-07-05 14:05:45 +02:00
Moonchild 962ca150bd Issue #2542 - Part 6: Add Sec-Fetch-User header for all requests that 
are the direct result of a system principal request.

This means navigation resulting from interaction with the browser UI
should result in a -user header (address bar navigation, bookmarks, etc.)
 2024-07-04 22:40:06 +02:00
Moonchild b693f60fc7 Issue #2542 - Part 5: Assume browser-initiated requests for unspecified 
content types to always be user-triggered.
 2024-07-04 22:34:00 +02:00
Moonchild a4cd652b6f Issue #2542 - Part 4b: Fix pointer mess-up. 2024-07-04 19:00:29 +02:00
Moonchild 689cbd7509 Issue #2542 - Part 4: Use BasePrincipal's IsSameOrigin() in SecFetch. 2024-07-03 17:03:36 +02:00
Moonchild 927173b648 Issue #2542 - Part 2b: Fix typo in pref check 2024-07-03 16:59:39 +02:00
Moonchild c62cc61613 Issue #2542 - Part 2: Base implementation of Sec-Fetch-* header code. 
Currently following Mozilla putting stuff in /dom for additional porting,
but it's actually the wrong location since it belongs in /netwerk with
the other code that deals with http headers.
 2024-07-03 11:00:53 +02:00
Moonchild b4a50f830c Issue #2542 - Part 1b: Fix dom.securecontext.whitelist code issues 
Some minor bugfixes (wrong condition and string type)
 2024-07-02 22:07:39 +02:00
Moonchild 5cadc0eee2 Issue #2542 - Part 1: Factor out Potentially Trustworthy URI checks. 
For sake of ease of use, converted to boolean functions that just assume "false"
in case of errors.

Note: Mozilla makes special arrangements for .onion addresses as well but
we explicitly do not adopt that. TOR browser can do that all day if it wants.
 2024-07-02 21:23:30 +02:00
Moonchild 06eca091f7 Issue #2466 - Part 3: Implement style-src-elem and style-src-attr 2024-02-04 23:24:50 +01:00
Moonchild 8fc5e4bd24 Issue #2466 - Part 2: Implement script-src-elem and script-src-attr 2024-02-04 20:15:14 +01:00
Moonchild 73e94dd628 Issue #2466 - Part 1: Reduce nsContentPolicy type usage. 
Use CSPDirective instead, since it directly deals with CSP anyway.
This cleanup prepares for the following changes.
 2024-02-04 13:33:32 +01:00
Brian Smith 391e17626b Issue #2402 - Fill in column in CSP Report. 2024-01-08 21:14:05 -06:00
Brian Smith 2150fb7fa9 Issue #2402 - Print Related JS-Line on CSP Violation (if any). 
https://bugzilla.mozilla.org/show_bug.cgi?id=1100630
 2024-01-08 08:49:05 -06:00
Brian Smith 3dd8bc0ddb Issue #2402 - CSP Violation events should have the correct sample for inline contexts. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1473587
Add preference to increase max length of CSP report source sample.
https://bugzilla.mozilla.org/show_bug.cgi?id=1415352
Return valid columnNumber value in CSP violation events.
https://bugzilla.mozilla.org/show_bug.cgi?id=1418246
 2024-01-08 07:46:11 -06:00
Brian Smith 0fe8ac9349 Issue #2402 - Workers.setTimeout/setInterval must handle CSP rejections. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1490165
Has some namespace issues adding the files, so differs slightly.
 2024-01-08 03:22:44 -06:00
Brian Smith d20b1f2fb6 Issue #2402 - CSP violation: blockedURI inline/eval. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1418241
CSP: Blocked URI should be empty for inline violations.
https://bugzilla.mozilla.org/show_bug.cgi?id=1236222
 2024-01-07 11:48:56 -06:00
Brian Smith 80207d6d3f Issue #2402 - importScripts should be governed by script-src in Web Workers. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1322111
Add TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS content policy.
Update the Cache API schema to account for new nsIContentPolicy type.
 2024-01-06 15:32:04 -06:00
Brian Smith ec5d6d9b5d Issue #2402 - Fix SecurityPolicyViolationEvent.violatedDirective. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1418243
 2024-01-06 15:32:02 -06:00
Brian Smith d9bd92c926 Issue #2402 - Implement security policy violation event. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1037335
 2024-01-06 15:32:02 -06:00
Brian Smith afeab7fe26 Issue #2402 - Remove child-src deprecation warning. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1486331
 2024-01-06 15:32:02 -06:00
Brian Smith ba183ce002 Issue #2402 - Ignore empty CSP directives. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1439425
 2024-01-06 15:32:02 -06:00
Moonchild 49a6a85969 Issue #2405 - Add a pref to disable CSP reporting. 
Resolves #2405
 2023-12-17 22:56:04 +01:00
Moonchild 88a656ec70 [DOM] Check if rootDoc is secure context for web compat 2023-11-23 14:44:33 +01:00
Moonchild 24ee0680b1 [DOM security] Be more explicit about CSP checks and reports. 2022-09-21 14:08:22 +00:00
Moonchild 92452d7614 Issue #80 - reinstated unified building for some large chunks of our code. 
This should reduce compile complexity saving time and reducing linker stress.
 2022-09-04 11:50:24 +00:00
Moonchild a95439db61 Issue #1822 - Part 3: Remove LOAD_CLASSIFIER_URI and various 
helper functions.
 2022-04-01 16:03:01 +02:00
Moonchild c0db767c25 Issue #1710 - Check for triggering principal URI in FTP subresource check. 
Resolves #1710
 2021-01-09 19:19:39 +00:00
Moonchild d5a2c45aad Issue #1656 - Part 6: Clean up the build files 2020-09-23 15:52:00 +00:00
Moonchild 7572f37186 Issue #1656 - Part 2: Unmangle some unfortunate UTF-8 victims. 
The poor fellows got lost in an ASCII-interpretation of the world.
 2020-09-23 14:52:16 +00:00
Moonchild a680bdc637 Issue #1656 - Part 1: Nuke most vim config lines in the tree. 
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
 2020-09-23 13:55:00 +00:00
MoonchildandGaming4JC f828451e5f Issue #1525 - Kill marquee element 
* Remove marquee code
* Regenerate HTML Elements/parser code for Removal of Marquee.

Co-authored-by: Gaming4JC <g4jc@hyperbola.info>
 2020-06-01 14:16:06 +02:00
Moonchild eb8a6523b8 Issue #80 - De-unify dom/security 
Exception: CSPUtils relies on something in CSPContext, but on
Windows it throws in an MSVC include which provides no hints.
 2020-04-23 14:13:58 +00:00
wolfbeast 6184ed7555 [CSP] Allow not having a Port for RessourceURI if the Scheme has no 
Default Port
 2020-02-11 12:30:45 +01:00
wolfbeast 6db06749e2 Fix whitelisting of JavaScript-uris by CSP hash. 2019-09-05 18:42:49 +02:00
Sebastian Streich 334a892eb5 Add checks to respect CSP-wildcard + Ports. 2019-09-05 09:48:51 +02:00
win7-7 deae241f5e Convert dom/base/nsImageLoadingContent.cpp to use AsyncOpen2 and followups along with it (1445670 and 1373780 part 2 and 3) 
Convert dom/base/nsImageLoadingContent.cpp to use AsyncOpen2 and followups along with it (1445670 and 1373780 part 2 and 3)
 2019-08-08 16:44:51 +03:00
wolfbeast 4491ec5eac Selectively allow ftp subresources in the blocked mode. 
- Allow "Save As..." downloads
- Allow subresource use if the top-level document is also on FTP
 2019-07-15 13:20:53 +02:00
wolfbeast d9aff90f06 Add preference to allow the loading of FTP subresources for corner cases 2019-07-14 22:41:01 +02:00
wolfbeast 6b4d81521f Prevent loading of document subresources over FTP. 2019-03-09 08:15:36 +01:00