New issue
Advanced search Search tips

Issue 595004 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 233903
Owner: ----
Closed: Mar 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

Bookmarklets affected by CSP policies

Reported by dante3...@gmail.com, Mar 15 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0

Steps to reproduce the problem:
Steps to reproduce:

Just install a bookmarket. For example, install http://ffoodd.github.io/a11y.css/ and test it on a website with CSP enabled.

Here is an example: http://csp.nicolas-hoffmann.net/ (see bug https://bugzilla.mozilla.org/show_bug.cgi?id=1195302 to see how this page works, basically, it makes an ajax call to retrieve CSP errors generated)

Use the bookmarklet on it (and refresh, it will display CSP errors).

What is the expected behavior?
Bookmarklet should not generate CSP errors.

What went wrong?
For the a11y.css bookmarklet, if CSP is activated on a website without some rules especially dedicated for it, Firefox triggers CSP errors.

For this case, I had to add 'unsafe-inline' to script-src and https://rawgit.com/ to  style-src directives.

Did this work before? No 

Chrome version: <Copy from: 'ab49.0.2623.87 (Build officiel) m (32 bits)out:version'>  Channel: stable
OS Version: 10.0
Flash Version: Shockwave Flash 21.0 r0
 

Comment 1 by mea...@chromium.org, Mar 15 2016

Components: Blink>SecurityFeature
Labels: -Restrict-View-SecurityTeam
Mergedinto: 233903
Status: Duplicate (was: Unconfirmed)
Thanks for the report. Looks like we have a long standing bug for this (bug 233903), so merging there.
Labels: allpublic

Sign in to add a comment