Moonchild
3a6d7f624f
No issue - Adjust CSP URI reporting more closely with the spec.
...
According to the W3C discussion we should allow websocket URIs to be
reported aside from http/https/ftp ones.
This rewrites things slightly and updates comments to clarify.
We do retain the non-standard reduction to origin only in case the
report is for cross-origin URIs (stops leaking full URIs to the CSP
reported destination).
See https://github.com/w3c/webappsec-csp/issues/735
2025-07-23 07:40:45 +02:00
Moonchild
52f31a682d
Issue #2728 - Remove obsolete CSP referrer policy.
...
This has been superseded by the dedicated Referrer-policy header.
Resolves #2728
2025-04-24 14:27:39 +02:00
Moonchild
6592cdfb42
[DOM] Honor security.csp.reporting.enabled pref in more places.
2025-02-18 09:59:26 +01:00
Moonchild
06eca091f7
Issue #2466 - Part 3: Implement style-src-elem and style-src-attr
2024-02-04 23:24:50 +01:00
Moonchild
8fc5e4bd24
Issue #2466 - Part 2: Implement script-src-elem and script-src-attr
2024-02-04 20:15:14 +01:00
Moonchild
73e94dd628
Issue #2466 - Part 1: Reduce nsContentPolicy type usage.
...
Use CSPDirective instead, since it directly deals with CSP anyway.
This cleanup prepares for the following changes.
2024-02-04 13:33:32 +01:00
Brian Smith
391e17626b
Issue #2402 - Fill in column in CSP Report.
2024-01-08 21:14:05 -06:00
Brian Smith
2150fb7fa9
Issue #2402 - Print Related JS-Line on CSP Violation (if any).
...
https://bugzilla.mozilla.org/show_bug.cgi?id=1100630
2024-01-08 08:49:05 -06:00
Brian Smith
3dd8bc0ddb
Issue #2402 - CSP Violation events should have the correct sample for inline contexts.
...
https://bugzilla.mozilla.org/show_bug.cgi?id=1473587
Add preference to increase max length of CSP report source sample.
https://bugzilla.mozilla.org/show_bug.cgi?id=1415352
Return valid columnNumber value in CSP violation events.
https://bugzilla.mozilla.org/show_bug.cgi?id=1418246
2024-01-08 07:46:11 -06:00
Brian Smith
d20b1f2fb6
Issue #2402 - CSP violation: blockedURI inline/eval.
...
https://bugzilla.mozilla.org/show_bug.cgi?id=1418241
CSP: Blocked URI should be empty for inline violations.
https://bugzilla.mozilla.org/show_bug.cgi?id=1236222
2024-01-07 11:48:56 -06:00
Brian Smith
ec5d6d9b5d
Issue #2402 - Fix SecurityPolicyViolationEvent.violatedDirective.
...
https://bugzilla.mozilla.org/show_bug.cgi?id=1418243
2024-01-06 15:32:02 -06:00
Brian Smith
d9bd92c926
Issue #2402 - Implement security policy violation event.
...
https://bugzilla.mozilla.org/show_bug.cgi?id=1037335
2024-01-06 15:32:02 -06:00
Moonchild
49a6a85969
Issue #2405 - Add a pref to disable CSP reporting.
...
Resolves #2405
2023-12-17 22:56:04 +01:00
Moonchild
24ee0680b1
[DOM security] Be more explicit about CSP checks and reports.
2022-09-21 14:08:22 +00:00
Moonchild
a95439db61
Issue #1822 - Part 3: Remove LOAD_CLASSIFIER_URI and various
...
helper functions.
2022-04-01 16:03:01 +02:00
Moonchild
7572f37186
Issue #1656 - Part 2: Unmangle some unfortunate UTF-8 victims.
...
The poor fellows got lost in an ASCII-interpretation of the world.
2020-09-23 14:52:16 +00:00
Moonchild
a680bdc637
Issue #1656 - Part 1: Nuke most vim config lines in the tree.
...
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
2020-09-23 13:55:00 +00:00
wolfbeast
6db06749e2
Fix whitelisting of JavaScript-uris by CSP hash.
2019-09-05 18:42:49 +02:00
wolfbeast
b7d9dad58e
Remove MOZ_B2G leftovers and some dead B2G-only components.
2018-05-12 14:32:03 +02:00
janekptacijarabaci
95c4608241
Bug 1329288: Allow content policy consumers to identify contentPolicy checks from docshell
2018-04-22 20:38:02 +02:00
janekptacijarabaci
7d67148f52
moebius#159: CSP - support for "frame-ancestors" in "Content-Security-Policy-Report-Only"
...
https://github.com/MoonchildProductions/moebius/pull/159
2018-04-14 22:22:59 +02:00
janekptacijarabaci
b4dac5093a
CSP: Ignore nonces on <img> per spec
2018-02-22 11:20:38 +01:00
janekptacijarabaci
62d5359679
CSP 2 - ignore (x-)frame-options if CSP with frame-ancestors directive exists
2018-02-22 11:15:23 +01:00
Matt A. Tobin
5f8de423f1
Add m-esr52 at 52.6.0
2018-02-02 04:16:08 -05:00
Moonchild
Brian Smith
wolfbeast
wolfbeast
janekptacijarabaci
Matt A. Tobin