From ecd4e361f36c57dbef227f2951ac66ebcbd8cfb8 Mon Sep 17 00:00:00 2001 From: Fritz Michael Gschwantner Date: Mon, 8 Jan 2024 22:25:14 +0000 Subject: [PATCH 1/2] filter view-source reports --- .../Violation/Filter/BrowserBugsNoiseDetector.php | 5 +++++ tests/ContentSecurityPolicy/Violation/FilterTest.php | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/src/ContentSecurityPolicy/Violation/Filter/BrowserBugsNoiseDetector.php b/src/ContentSecurityPolicy/Violation/Filter/BrowserBugsNoiseDetector.php index a76fbc49..1f364756 100644 --- a/src/ContentSecurityPolicy/Violation/Filter/BrowserBugsNoiseDetector.php +++ b/src/ContentSecurityPolicy/Violation/Filter/BrowserBugsNoiseDetector.php @@ -55,6 +55,11 @@ public function match(Report $report, Request $request): bool } } + // https://bugzilla.mozilla.org/show_bug.cgi?id=1873553 + if ('view-source' === $report->getSourceFile()) { + return true; + } + // files loaded by safari & firefox extension // should be allowed as in Chrome if ( diff --git a/tests/ContentSecurityPolicy/Violation/FilterTest.php b/tests/ContentSecurityPolicy/Violation/FilterTest.php index f34fc0d4..3fdc8b97 100644 --- a/tests/ContentSecurityPolicy/Violation/FilterTest.php +++ b/tests/ContentSecurityPolicy/Violation/FilterTest.php @@ -229,6 +229,11 @@ public function provideVariousCases(): array 'blocked-uri' => 'www.gstatic.com', 'effective-directive' => 'script-src', ]], + [true, new Request(), [ + 'blocked-uri' => 'inline', + 'source-file' => 'view-source', + 'effective-directive' => 'style-src-attr', + ]] ]; } } From 6b987b76de06a142d880acb50820ce5b4e89a099 Mon Sep 17 00:00:00 2001 From: Fritz Michael Gschwantner Date: Mon, 8 Jan 2024 22:50:08 +0000 Subject: [PATCH 2/2] cs fix --- tests/ContentSecurityPolicy/Violation/FilterTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/ContentSecurityPolicy/Violation/FilterTest.php b/tests/ContentSecurityPolicy/Violation/FilterTest.php index 3fdc8b97..267e1d0e 100644 --- a/tests/ContentSecurityPolicy/Violation/FilterTest.php +++ b/tests/ContentSecurityPolicy/Violation/FilterTest.php @@ -233,7 +233,7 @@ public function provideVariousCases(): array 'blocked-uri' => 'inline', 'source-file' => 'view-source', 'effective-directive' => 'style-src-attr', - ]] + ]], ]; } }