Evaluate and Assert that all about: pages on Android ship with a strong CSP
Categories
(Core :: DOM: Security, task)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox71 | --- | fixed |
People
(Reporter: ckerschb, Assigned: ckerschb)
References
Details
(Whiteboard: [domsecurity-active])
Attachments
(1 file)
|
(deleted),
text/x-phabricator-request
|
Details |
It seems we have !defined(ANDROID) where we do the assert to make sure all about pages ship with a strong CSP [1]. We should remove that and make sure all about: pages on android also have a strong CSP.
[1] https://hg.mozilla.org/mozilla-central/rev/42ac00d4125c#l1.30
|
||
Comment 1•5 years ago
|
||
|
Assignee | |
Comment 2•5 years ago
|
||
Snorp, we are currently applying strong CSPs to all of our about: pages (at least for desktop). In a first try run [1] I wanted to see how much work there is on android. It seems like a lot :-(
I assume every single about: page is different on android and desktop versions of Firefox? I can certainly tackle some of them, but I was wondering if we coordinate the effort somehow to get some help with that. Happy to hop on a meeting to discuss details. Just wanted to get your initial feedback on how we could tackle that and also apply strong CSPs to all of android's about: pages.
For GeckoView, I think we really only have about:config as special. Fennec has more[1], and we might be accidentally including some of those in GeckoView. Maybe there should be some kind of audit done at the same time?
[1] https://searchfox.org/mozilla-central/source/mobile/android/chrome/content
|
|
Assignee | |
Comment 4•5 years ago
|
||
|
||
Comment 6•5 years ago
|
||
| bugherder | ||
Description
•