Closed
Bug 1157724
Opened 10 years ago
Closed 10 years ago
html5test doesn't detect script execution events
Categories
(Core :: DOM: Events, defect)
Core
DOM: Events
Tracking
()
RESOLVED
INVALID
People
(Reporter: mak, Unassigned)
References
()
Details
I just noticed current Nightly reports a No for Script Execution Events on Html5test, but looks like previous version were reporting Yes.
Comment 1•10 years ago
|
||
mozregression info:
Last good revision: 883e17fc475f (2015-04-06)
First bad revision: ab0490972e1e (2015-04-07)
Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=883e17fc475f&tochange=ab0490972e1e
Last good revision: 0613b7a78686
First bad revision: 183190289b9c
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=0613b7a78686&tochange=183190289b9c
Sebastian
OS: Unspecified → All
Hardware: Unspecified → All
Version: unspecified → Trunk
Reporter | ||
Comment 2•10 years ago
|
||
Looks like it's related to CSP, I see blocked messages in the console when the page runs
Blocks: CVE-2015-4490
Flags: needinfo?(mozilla)
Comment 3•10 years ago
|
||
You're right. To be specific, the following message relates to the test on html5test.com:
Content Security Policy: The page's settings blocked the loading of a resource at data:text/javascript;charset=utf-8,window ("default-src 'unsafe-inline' *").
This indicates that this is caused by the changes of bug 1086999. The related spec says[1] that the data: scheme is not included in the '*' CSP. So this seems to be rather a bug on html5test.com than in Firefox, as the CSP there looks like this:
default-src 'unsafe-inline' *; frame-src *; options inline-script;
Therefore I filed an issue for html5test.com:
https://github.com/NielsLeenheer/html5test/issues/387
Sebastian
[1] http://www.w3.org/TR/CSP11/#match-source-expression
Flags: needinfo?(mozilla)
Updated•10 years ago
|
Reporter | ||
Comment 4•10 years ago
|
||
should we move this as an open bug in tech evang?
Reporter | ||
Comment 5•10 years ago
|
||
Ah, I see you filed a bug on github, thanks!
Comment 6•10 years ago
|
||
(In reply to Marco Bonardo [::mak] from comment #4)
> should we move this as an open bug in tech evang?
There's already some discussion about that in bug 1086999. You may ask there again.
Sebastian
Updated•10 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•