When working on Bug 1387684 I realized that having a data: URI iframe which uses a meta CSP including 'self' translates 'self' into a data: URI. We fix the issue within Bug 1387684, but we should write out own testcase for it because the wpt test for this relies on the policy violation events (see Bug 1302962), which we haven't implemented yet.

This needs a little more work than I expected. When flipping the pref so data: URIs become unique opaque origins, then we get the following values when running that test: Within CSP_CreateHostSrcFromSelfURI: aSelfURI: moz-nullprincipal:{6955d7ca-7420-489e-b5f1-2c1ffd31698f} scheme: moz-nullprincipal host: port: 32764 which ultimately translates 'self' into: moz-nullprincipal://:32764 within the attached testcase. I am not entirely sure how we should handle that case. I guess it needs a little more discussion with Dan and others.

As described in [1], the test within this bug will land together with the changes from Bug 1387684. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1387684#c18

Comment on attachment 8897813 [details] [diff] [review] bug_1387871_test_meta_csp_self.patch Review of attachment 8897813 [details] [diff] [review]: ----------------------------------------------------------------- Am I still reviewing this patch, or will there be another version? I'm not keen on translating moz-nullprincipal: to unique-opaque-origin: because moz-nullprincipal should already mean a unique origin. According to the URL spec (WHATWG) a unique origin shouldn't match even itself so you could just have things fail. Or, a more common-sense interpretation of a "unique" origin would allow it to match itself (exactly!) but not other URLs of the same scheme. There are URL types that don't have hosts that aren't moz-nullprincipal. Basically, if a URL has a host then it's a scheme+host+port origin comparison; if it doesn't then it's a "unique origin" and we can either common-sense compare the entire URL, or go the "unique origin" definition and simply fail the comparison once we hit that point.

Comment on attachment 8897813 [details] [diff] [review] bug_1387871_test_meta_csp_self.patch Review of attachment 8897813 [details] [diff] [review]: ----------------------------------------------------------------- Let's hold off on the review until we see what happens in Bug 1387684

Pushed by mozilla@christophkerschbaumer.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/6c69390e7b8a CSP: Test 'self' within meta csp in data: URI iframe. r=dveditz