# HG changeset patch # User Jason Tarka # Date 1500315597 14400 # Mon Aug 21 11:36:57 2017 -0400 # Node ID 804e848e3bab98f99c82012501ae1ed23afb274b # Parent a6a1f5c1d971dbee67ba6eec7ead7902351ddca2 Bug 1380755 - Examine & report on frame-ancestors CSP in report-only mode Despite what the comment here says, there is nowhere in the W3C CSP spec stating that frame-ancestors should be ignored in report-only mode. diff -r a6a1f5c1d971 -r 804e848e3bab dom/security/nsCSPContext.cpp --- a/dom/security/nsCSPContext.cpp Thu Aug 17 16:16:51 2017 -0700 +++ b/dom/security/nsCSPContext.cpp Mon Aug 21 11:36:57 2017 -0400 @@ -224,14 +224,6 @@ nsAutoString violatedDirective; for (uint32_t p = 0; p < mPolicies.Length(); p++) { - - // According to the W3C CSP spec, frame-ancestors checks are ignored for - // report-only policies (when "monitoring"). - if (aDir == nsIContentSecurityPolicy::FRAME_ANCESTORS_DIRECTIVE && - mPolicies[p]->getReportOnlyFlag()) { - continue; - } - if (!mPolicies[p]->permits(aDir, aContentLocation, aNonce, diff -r a6a1f5c1d971 -r 804e848e3bab dom/security/test/csp/file_bug1380755_child.html --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/dom/security/test/csp/file_bug1380755_child.html Mon Aug 21 11:36:57 2017 -0400 @@ -0,0 +1,10 @@ + + + + + + + + + diff -r a6a1f5c1d971 -r 804e848e3bab dom/security/test/csp/file_bug1380755_child.html^headers^ --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/dom/security/test/csp/file_bug1380755_child.html^headers^ Mon Aug 21 11:36:57 2017 -0400 @@ -0,0 +1,1 @@ +Content-Security-Policy-Report-Only: frame-ancestors 'none'; report-uri http://mochi.test:8888/foo.sjs diff -r a6a1f5c1d971 -r 804e848e3bab dom/security/test/csp/mochitest.ini --- a/dom/security/test/csp/mochitest.ini Thu Aug 17 16:16:51 2017 -0700 +++ b/dom/security/test/csp/mochitest.ini Mon Aug 21 11:36:57 2017 -0400 @@ -90,6 +90,8 @@ file_bug941404.html file_bug941404_xhr.html file_bug941404_xhr.html^headers^ + file_bug1380755_child.html + file_bug1380755_child.html^headers^ file_hash_source.html file_dual_header_testserver.sjs file_hash_source.html^headers^ @@ -245,6 +247,7 @@ [test_bug910139.html] [test_bug909029.html] [test_bug1229639.html] +[test_bug1380755.html] [test_policyuri_regression_from_multipolicy.html] [test_nonce_source.html] [test_bug941404.html] diff -r a6a1f5c1d971 -r 804e848e3bab dom/security/test/csp/test_bug1380755.html --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/dom/security/test/csp/test_bug1380755.html Mon Aug 21 11:36:57 2017 -0400 @@ -0,0 +1,79 @@ + + + + Test for frame-ancestors support in Content-Security-Policy-Report-Only + + + + + + + +