Security: DevTools Network panel response preview does not honor header CSP
Reported by
exhnoz...@gmail.com,
Jul 7
|
||||||||
Issue descriptionVULNERABILITY DETAILS On a web page with a Content Security Policy, the CSP header is ignored in the response Preview on the DevTools Network panel. When the CSP is in a header, the images, stylesheets, and webfonts are requested and displayed as if there were no CSP. The CSP appears to be respected when it is in a meta tag (though displaying the preview seems to cause the thumbnail images from #860840 to reload). VERSION Chrome Version: 67.0.3396.99 stable Operating System: Windows 10 Pro Version 1803 OS Build 17134.112 REPRODUCTION CASE The preview only seems to load resources with full URLs, so that is an important part of reproducing this. Run a local PHP development server with this command: php -S localhost:9999 Load http://localhost:9999/index.php with DevTools open to the Network panel. See the text is not bold, and log.php has Status (blocked:csp) (and log.txt is empty). Click index.php on the Network panel, then go to the Preview tab. See the text is bold in the preview. Open log.txt and see that a request was logged by log.php. index.php: <?php header("Content-Security-Policy: default-src 'none'"); ?> <!DOCTYPE html> <link href="http://localhost:9999/log.php" rel="stylesheet"> This text should not be bold. log.php: <?php file_put_contents('log.txt', var_export($_SERVER, true) . PHP_EOL, FILE_APPEND); header('Cache-Control: no-cache, no-store, must-revalidate'); header('Content-Type: text/css'); ?> body { font-weight: bold; } log.txt: [Empty file that log.php can write to]
,
Jul 9
+tsepez for thoughts/triage
,
Jul 10
CCing some devtools folks. It does seem to me that we should apply the policy delivered along with the preview to the previewed page. It's not clear to me what origin the preview runs in, though: is it rendered via a `data:` URL, for instance?
,
Jul 10
Issue 860840 has been merged into this issue.
,
Jul 10
Does any JavaScript run when rendering a preview?
,
Jul 10
,
Jul 11
As far as I can tell, no JavaScript runs in the preview.
,
Jul 17
,
Jul 17
re #c3: this preview is indeed rendered via `data:` URL. Does that disables CSP or some other features? Is of, I'll WontFix this issue since we do not aim for the perfect replica in preview.
,
Jul 27
,
Aug 27
As per #9, wontfixing.
,
Dec 4
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by kenrb@chromium.org
, Jul 7