1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "WorkerCSPContext.h"
#include "mozilla/StaticPrefs_dom.h"
#include "mozilla/dom/WorkerCommon.h"
#include "mozilla/dom/WorkerPrivate.h"
#include "mozilla/dom/nsCSPParser.h"
#include "mozilla/dom/nsCSPUtils.h"
#include "mozilla/ipc/BackgroundUtils.h"
#include "nsNetUtil.h"
namespace mozilla::dom {
/* static */
Result<UniquePtr<WorkerCSPContext>, nsresult> WorkerCSPContext::CreateFromCSP(
nsIContentSecurityPolicy* aCSP) {
AssertIsOnMainThread();
mozilla::ipc::CSPInfo cspInfo;
nsresult rv = CSPToCSPInfo(aCSP, &cspInfo);
if (NS_FAILED(rv)) {
return Err(rv);
}
return MakeUnique<WorkerCSPContext>(std::move(cspInfo));
}
const nsTArray<UniquePtr<const nsCSPPolicy>>& WorkerCSPContext::Policies() {
EnsureIPCPoliciesRead();
return mPolicies;
}
bool WorkerCSPContext::IsEvalAllowed(bool& aReportViolation) {
MOZ_ASSERT(!aReportViolation);
bool trustedTypesRequired =
(mCSPInfo.requireTrustedTypesForDirectiveState() ==
RequireTrustedTypesForDirectiveState::ENFORCE);
for (const UniquePtr<const nsCSPPolicy>& policy : Policies()) {
if (!(trustedTypesRequired &&
policy->allows(nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE,
CSP_TRUSTED_TYPES_EVAL, u""_ns)) &&
!policy->allows(nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE,
CSP_UNSAFE_EVAL, u""_ns)) {
aReportViolation = true;
if (!policy->getReportOnlyFlag()) {
return false;
}
}
}
return true;
}
bool WorkerCSPContext::IsWasmEvalAllowed(bool& aReportViolation) {
MOZ_ASSERT(!aReportViolation);
for (const UniquePtr<const nsCSPPolicy>& policy : Policies()) {
// Either 'unsafe-eval' or 'wasm-unsafe-eval' can allow this
if (!policy->allows(nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE,
CSP_WASM_UNSAFE_EVAL, u""_ns) &&
!policy->allows(nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE,
CSP_UNSAFE_EVAL, u""_ns)) {
aReportViolation = true;
if (!policy->getReportOnlyFlag()) {
return false;
}
}
}
return true;
}
void WorkerCSPContext::EnsureIPCPoliciesRead() {
MOZ_DIAGNOSTIC_ASSERT(!!GetCurrentThreadWorkerPrivate());
if (!mPolicies.IsEmpty() || mCSPInfo.policyInfos().IsEmpty()) {
return;
}
nsCOMPtr<nsIURI> selfURI;
if (NS_WARN_IF(NS_FAILED(
NS_NewURI(getter_AddRefs(selfURI), mCSPInfo.selfURISpec())))) {
return;
}
for (const auto& policy : mCSPInfo.policyInfos()) {
UniquePtr<const nsCSPPolicy> cspPolicy(
nsCSPParser::parseContentSecurityPolicy(
policy.policy(), selfURI, policy.reportOnlyFlag(), nullptr,
policy.deliveredViaMetaTagFlag(),
/* aSuppressLogMessages */ true));
if (cspPolicy) {
mPolicies.AppendElement(std::move(cspPolicy));
}
}
}
} // namespace mozilla::dom
|
