Bug 1415352: Part 2 - Exempt inline CSS from extension principals from CSP. r?bz
MozReview-Commit-ID: D0dofgOaLXZ
--- a/dom/base/nsStyleLinkElement.cpp
+++ b/dom/base/nsStyleLinkElement.cpp
@@ -535,16 +535,17 @@ nsStyleLinkElement::DoUpdateStyleSheet(n
if (!nsContentUtils::GetNodeTextContent(thisContent, false, text, fallible)) {
return NS_ERROR_OUT_OF_MEMORY;
}
MOZ_ASSERT(thisContent->NodeInfo()->NameAtom() != nsGkAtoms::link,
"<link> is not 'inline', and needs different CSP checks");
if (!nsStyleUtil::CSPAllowsInlineStyle(thisContent,
thisContent->NodePrincipal(),
+ nullptr,
doc->GetDocumentURI(),
mLineNumber, text, &rv))
return rv;
// Parse the style sheet.
rv = doc->CSSLoader()->
LoadInlineStyle(thisContent, text, mLineNumber, title, media,
referrerPolicy, scopeElement, aObserver, &doneLoading,
--- a/dom/base/nsStyledElement.cpp
+++ b/dom/base/nsStyledElement.cpp
@@ -184,16 +184,17 @@ nsStyledElement::ParseStyleAttribute(con
nsAttrValue& aResult,
bool aForceInDataDoc)
{
nsIDocument* doc = OwnerDoc();
bool isNativeAnon = IsInNativeAnonymousSubtree();
if (!isNativeAnon &&
!nsStyleUtil::CSPAllowsInlineStyle(nullptr, NodePrincipal(),
+ aMaybeScriptedPrincipal,
doc->GetDocumentURI(), 0, aValue,
nullptr))
return;
if (aForceInDataDoc ||
!doc->IsLoadedAsData() ||
GetExistingStyle() ||
doc->IsStaticDocument()) {
--- a/dom/smil/nsSMILCSSValueType.cpp
+++ b/dom/smil/nsSMILCSSValueType.cpp
@@ -751,16 +751,17 @@ nsSMILCSSValueType::ValueFromString(nsCS
if (!presContext) {
NS_WARNING("Not parsing animation value; unable to get PresContext");
return;
}
nsIDocument* doc = aTargetElement->GetUncomposedDoc();
if (doc && !nsStyleUtil::CSPAllowsInlineStyle(nullptr,
doc->NodePrincipal(),
+ nullptr,
doc->GetDocumentURI(),
0, aString, nullptr)) {
return;
}
RefPtr<nsStyleContext> styleContext =
nsComputedDOMStyle::GetStyleContext(aTargetElement, nullptr,
presContext->PresShell());
@@ -806,16 +807,17 @@ nsSMILCSSValueType::ValueFromAnimationVa
// We'd like to avoid serializing |aValue| if possible, and since the
// string passed to CSPAllowsInlineStyle is only used for reporting violations
// and an intermediate CSS value is not likely to be particularly useful
// in that case, we just use a generic placeholder string instead.
static const nsLiteralString kPlaceholderText =
NS_LITERAL_STRING("[SVG animation of CSS]");
if (doc && !nsStyleUtil::CSPAllowsInlineStyle(nullptr,
doc->NodePrincipal(),
+ nullptr,
doc->GetDocumentURI(),
0, kPlaceholderText, nullptr)) {
return result;
}
sSingleton.Init(result);
result.mU.mPtr = new ValueWrapper(aPropID, aValue);
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -830,33 +830,40 @@ nsStyleUtil::ObjectPropsMightCauseOverfl
return false;
}
/* static */ bool
nsStyleUtil::CSPAllowsInlineStyle(nsIContent* aContent,
nsIPrincipal* aPrincipal,
+ nsIPrincipal* aTriggeringPrincipal,
nsIURI* aSourceURI,
uint32_t aLineNumber,
const nsAString& aStyleText,
nsresult* aRv)
{
nsresult rv;
if (aRv) {
*aRv = NS_OK;
}
MOZ_ASSERT(!aContent || aContent->NodeInfo()->NameAtom() == nsGkAtoms::style,
"aContent passed to CSPAllowsInlineStyle "
"for an element that is not <style>");
+ nsIPrincipal* principal = aPrincipal;
+ if (aTriggeringPrincipal &&
+ BasePrincipal::Cast(aTriggeringPrincipal)->OverridesCSP(aPrincipal)) {
+ principal = aTriggeringPrincipal;
+ }
+
nsCOMPtr<nsIContentSecurityPolicy> csp;
- rv = aPrincipal->GetCsp(getter_AddRefs(csp));
+ rv = principal->GetCsp(getter_AddRefs(csp));
if (NS_FAILED(rv)) {
if (aRv)
*aRv = rv;
return false;
}
if (!csp) {
--- a/layout/style/nsStyleUtil.h
+++ b/layout/style/nsStyleUtil.h
@@ -184,30 +184,34 @@ public:
* The <style> element that the caller wants to know whether to honor.
* Included to check the nonce attribute if one is provided. Allowed to
* be null, if this is for something other than a <style> element (in
* which case nonces won't be checked).
* @param aPrincipal
* The principal of the of the document (*not* of the style sheet).
* The document's principal is where any Content Security Policy that
* should be used to block or allow inline styles will be located.
+ * @param aTriggeringPrincipal
+ * The principal of the scripted caller which added the inline
+ * stylesheet, or null if no scripted caller can be identified.
* @param aSourceURI
* URI of document containing inline style (for reporting violations)
* @param aLineNumber
* Line number of inline style element in the containing document (for
* reporting violations)
* @param aStyleText
* Contents of the inline style element (for reporting violations)
* @param aRv
* Return error code in case of failure
* @return
* Does CSP allow application of the specified inline style?
*/
static bool CSPAllowsInlineStyle(nsIContent* aContent,
nsIPrincipal* aPrincipal,
+ nsIPrincipal* aTriggeringPrincipal,
nsIURI* aSourceURI,
uint32_t aLineNumber,
const nsAString& aStyleText,
nsresult* aRv);
template<size_t N>
static bool MatchesLanguagePrefix(const char16_t* aLang, size_t aLen,
const char16_t (&aPrefix)[N])