Skip to content

Commit 18b9825

Browse files
committed
Bug 1848315 - CSP: Introduce new and more detailed error messages. r=freddyb,devtools-reviewers,flod
Differential Revision: https://phabricator.services.mozilla.com/D186143
1 parent d86f531 commit 18b9825

File tree

9 files changed

+388
-58
lines changed

9 files changed

+388
-58
lines changed

browser/base/content/test/static/browser_misused_characters_in_strings.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,28 @@ let gExceptionsList = [
6868
key: "MathML_DeprecatedMathVariantWarning",
6969
type: "single-quote",
7070
},
71+
// These error messages contain references to the CSP keywords 'unsafe-eval'/'wasm-unsafe-eval',
72+
// and those keywords contain actual single-quotes: https://w3c.github.io/webappsec-csp/#grammardef-keyword-source
73+
{
74+
file: "csp.properties",
75+
key: "CSPEvalScriptViolation",
76+
type: "single-quote",
77+
},
78+
{
79+
file: "csp.properties",
80+
key: "CSPROEvalScriptViolation",
81+
type: "single-quote",
82+
},
83+
{
84+
file: "csp.properties",
85+
key: "CSPWasmEvalScriptViolation",
86+
type: "single-quote",
87+
},
88+
{
89+
file: "csp.properties",
90+
key: "CSPROWasmEvalScriptViolation",
91+
type: "single-quote",
92+
},
7193
];
7294

7395
/**

devtools/client/webconsole/test/browser/browser_webconsole_csp_too_many_reports.js

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,18 @@ const TEST_URI =
1313
const TEST_VIOLATIONS =
1414
"https://example.com/browser/devtools/client/webconsole/" +
1515
"test/browser/test-csp-many-errors.html";
16-
const CSP_VIOLATION_MSG =
17-
"Content-Security-Policy: The page\u2019s settings blocked the loading of a resource " +
18-
"at inline (\u201cstyle-src\u201d).";
19-
const CSP_TOO_MANY_REPORTS_MSG =
20-
"Content-Security-Policy: Prevented too many CSP reports from being sent within a short period of time.";
16+
17+
const bundle = Services.strings.createBundle(
18+
"chrome://global/locale/security/csp.properties"
19+
);
20+
const CSP_VIOLATION_MSG = bundle.formatStringFromName(
21+
"CSPInlineStyleViolation",
22+
["style-src 'none'", "style-src-attr"]
23+
);
24+
const CSP_TOO_MANY_REPORTS_MSG = bundle.formatStringFromName(
25+
"tooManyReports",
26+
[]
27+
);
2128

2229
add_task(async function () {
2330
// Reduce the limit to reduce the log spam.

devtools/client/webconsole/test/browser/browser_webconsole_csp_violation.js

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@
77
"use strict";
88

99
add_task(async function () {
10+
const bundle = Services.strings.createBundle(
11+
"chrome://global/locale/security/csp.properties"
12+
);
13+
1014
const TEST_URI =
1115
"data:text/html;charset=utf8,<!DOCTYPE html>Web Console CSP violation test";
1216
const hud = await openNewTabAndConsole(TEST_URI);
@@ -15,10 +19,14 @@ add_task(async function () {
1519
const TEST_VIOLATION =
1620
"https://example.com/browser/devtools/client/webconsole/" +
1721
"test/browser/test-csp-violation.html";
18-
const CSP_VIOLATION_MSG =
19-
"Content-Security-Policy: The page\u2019s settings " +
20-
"blocked the loading of a resource at " +
21-
"http://some.example.com/test.png (\u201cimg-src\u201d).";
22+
const CSP_VIOLATION_MSG = bundle.formatStringFromName(
23+
"CSPGenericViolation",
24+
[
25+
"img-src https://example.com",
26+
"http://some.example.com/test.png",
27+
"img-src",
28+
]
29+
);
2230
const onRepeatedMessage = waitForRepeatedMessageByType(
2331
hud,
2432
CSP_VIOLATION_MSG,
@@ -35,9 +43,10 @@ add_task(async function () {
3543
const TEST_VIOLATION =
3644
"https://example.com/browser/devtools/client/webconsole/" +
3745
"test/browser/test-csp-violation-inline.html";
38-
const CSP_VIOLATION =
39-
`Content-Security-Policy: The page’s settings blocked` +
40-
` the loading of a resource at inline (“style-src”).`;
46+
const CSP_VIOLATION = bundle.formatStringFromName(
47+
"CSPInlineStyleViolation",
48+
["style-src 'self'", "style-src-elem"]
49+
);
4150
const VIOLATION_LOCATION_HTML = "test-csp-violation-inline.html:18:1";
4251
const VIOLATION_LOCATION_JS = "test-csp-violation-inline.html:14:25";
4352
await navigateTo(TEST_VIOLATION);
@@ -71,7 +80,11 @@ add_task(async function () {
7180
const TEST_VIOLATION =
7281
"https://example.com/browser/devtools/client/webconsole/" +
7382
"test/browser/test-csp-violation-base-uri.html";
74-
const CSP_VIOLATION = `Content-Security-Policy: The page’s settings blocked the loading of a resource at https://evil.com/ (“base-uri”).`;
83+
const CSP_VIOLATION = bundle.formatStringFromName("CSPGenericViolation", [
84+
"base-uri 'self'",
85+
"https://evil.com/",
86+
"base-uri",
87+
]);
7588
const VIOLATION_LOCATION = "test-csp-violation-base-uri.html:15:25";
7689
await navigateTo(TEST_VIOLATION);
7790
let msg = await waitFor(() => findErrorMessage(hud, CSP_VIOLATION));
@@ -97,7 +110,11 @@ add_task(async function () {
97110
const TEST_VIOLATION =
98111
"https://example.com/browser/devtools/client/webconsole/" +
99112
"test/browser/test-csp-violation-form-action.html";
100-
const CSP_VIOLATION = `Content-Security-Policy: The page’s settings blocked the loading of a resource at https://evil.com/evil.com (“form-action”).`;
113+
const CSP_VIOLATION = bundle.formatStringFromName("CSPGenericViolation", [
114+
"form-action 'self'",
115+
"https://evil.com/evil.com",
116+
"form-action",
117+
]);
101118
const VIOLATION_LOCATION = "test-csp-violation-form-action.html:14:40";
102119

103120
await navigateTo(TEST_VIOLATION);
@@ -116,9 +133,11 @@ add_task(async function () {
116133
const TEST_VIOLATION =
117134
"https://example.com/browser/devtools/client/webconsole/" +
118135
"test/browser/test-csp-violation-frame-ancestor-parent.html";
119-
const CSP_VIOLATION =
120-
`Content-Security-Policy: The page’s settings blocked` +
121-
` the loading of a resource at ${TEST_VIOLATION} (“frame-ancestors”).`;
136+
const CSP_VIOLATION = bundle.formatStringFromName("CSPGenericViolation", [
137+
"frame-ancestors 'none'",
138+
TEST_VIOLATION,
139+
"frame-ancestors",
140+
]);
122141
await navigateTo(TEST_VIOLATION);
123142
const msg = await waitFor(() => findErrorMessage(hud, CSP_VIOLATION));
124143
ok(msg, "Frame-Ancestors violation by html was printed");
@@ -129,8 +148,11 @@ add_task(async function () {
129148
const TEST_VIOLATION =
130149
"https://example.com/browser/devtools/client/webconsole/" +
131150
"test/browser/test-csp-violation-event-handler.html";
132-
const CSP_VIOLATION = `Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
133-
Source: document.body.textContent = 'JavaScript …`;
151+
const CSP_VIOLATION =
152+
bundle.formatStringFromName("CSPEventHandlerScriptViolation", [
153+
"script-src 'self'",
154+
"script-src-attr",
155+
]) + `\nSource: document.body.textContent = 'JavaScript …`;
134156
// Future-Todo: Include line and column number.
135157
const VIOLATION_LOCATION = "test-csp-violation-event-handler.html";
136158
await navigateTo(TEST_VIOLATION);

devtools/client/webconsole/test/browser/browser_webconsole_cspro.js

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,20 @@ const TEST_URI =
2121
const TEST_VIOLATION =
2222
"http://example.com/browser/devtools/client/webconsole/" +
2323
"test/browser/test-cspro.html";
24-
const CSP_VIOLATION_MSG =
25-
"Content-Security-Policy: The page\u2019s settings blocked the loading of a resource " +
26-
"at http://some.example.com/cspro.png (\u201cimg-src\u201d).";
27-
const CSP_REPORT_MSG =
28-
"Content-Security-Policy: The page\u2019s settings observed the loading of a " +
29-
"resource at http://some.example.com/cspro.js " +
30-
"(\u201cscript-src\u201d). A CSP report is being sent.";
24+
25+
const bundle = Services.strings.createBundle(
26+
"chrome://global/locale/security/csp.properties"
27+
);
28+
const CSP_VIOLATION_MSG = bundle.formatStringFromName("CSPGenericViolation", [
29+
"img-src 'self'",
30+
"http://some.example.com/cspro.png",
31+
"img-src",
32+
]);
33+
const CSP_REPORT_MSG = bundle.formatStringFromName("CSPROScriptViolation", [
34+
"script-src 'self'",
35+
"http://some.example.com/cspro.js",
36+
"script-src-elem",
37+
]);
3138

3239
add_task(async function () {
3340
const hud = await openNewTabAndConsole(TEST_URI);

dom/locales/en-US/chrome/security/csp.properties

Lines changed: 94 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,102 @@
44

55
# CSP Warnings:
66

7-
# LOCALIZATION NOTE (CSPViolationWithURI):
8-
# %1$S is the directive that has been violated.
7+
# LOCALIZATION NOTE (CSPInlineStyleViolation):
8+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
9+
# %2$S is the type of directive used by the resource (e.g. style-src-elem)
10+
CSPInlineStyleViolation = The page’s settings blocked an inline style (%2$S) from being applied because it violates the following directive: “%1$S”
11+
# LOCALIZATION NOTE (CSPROInlineStyleViolation):
12+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
13+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
14+
# %2$S is the type of directive used by the resource (e.g. style-src-elem)
15+
CSPROInlineStyleViolation = (Report-Only policy) The page’s settings would block an inline style (%2$S) from being applied because it violates the following directive: “%1$S”
16+
# LOCALIZATION NOTE (CSPInlineScriptViolation):
17+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
18+
# %2$S is the type of directive used by the resource (e.g. script-src-elem)
19+
CSPInlineScriptViolation = The page’s settings blocked an inline script (%2$S) from being executed because it violates the following directive: “%1$S”
20+
# LOCALIZATION NOTE (CSPROInlineScriptViolation):
21+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
22+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
23+
# %2$S is the type of directive used by the resource (e.g. script-src-elem)
24+
CSPROInlineScriptViolation = (Report-Only policy) The page’s settings would block an inline script (%2$S) from being executed because it violates the following directive: “%1$S”
25+
# LOCALIZATION NOTE (CSPEventHandlerScriptViolation):
26+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
27+
# %2$S is the type of directive used by the resource (e.g. script-src-attr)
28+
CSPEventHandlerScriptViolation = The page’s settings blocked an event handler (%2$S) from being executed because it violates the following directive: “%1$S”
29+
# LOCALIZATION NOTE (CSPROEventHandlerScriptViolation):
30+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
31+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
32+
# %2$S is the type of directive used by the resource (e.g. script-src-attr)
33+
CSPROEventHandlerScriptViolation = (Report-Only policy) The page’s settings would block an event handler (%2$S) from being executed because it violates the following directive: “%1$S”
34+
# LOCALIZATION NOTE (CSPEvalScriptViolation):
35+
# Don't translate/change "'unsafe-eval'", including the single quote.
36+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
37+
# %2$S is the type of directive used by the resource (e.g. script-src)
38+
CSPEvalScriptViolation = The page’s settings blocked a JavaScript eval (%2$S) from being executed because it violates the following directive: “%1$S” (Missing 'unsafe-eval')
39+
# LOCALIZATION NOTE (CSPROEvalScriptViolation):
40+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
41+
# Don't translate/change "'unsafe-eval'", including the single quote.
42+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
43+
# %2$S is the type of directive used by the resource (e.g. script-src)
44+
CSPROEvalScriptViolation = (Report-Only policy) The page’s settings would block a JavaScript eval (%2$S) from being executed because it violates the following directive: “%1$S” (Missing 'unsafe-eval')
45+
# LOCALIZATION NOTE (CSPWasmEvalScriptViolation):
46+
# WebAssembly is a feature name.
47+
# Don't translate/change "'wasm-unsafe-eval'" or "'unsafe-eval'", including the single quote.
48+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
49+
# %2$S is the type of directive used by the resource (e.g. script-src)
50+
CSPWasmEvalScriptViolation = The page’s settings blocked WebAssembly (%2$S) from being executed because it violates the following directive: “%1$S” (Missing 'wasm-unsafe-eval' or 'unsafe-eval')
51+
# LOCALIZATION NOTE (CSPROWasmEvalScriptViolation):
52+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
53+
# WebAssembly is a feature name.
54+
# Don't translate/change "'wasm-unsafe-eval'" or "'unsafe-eval'", including the single quote.
55+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
56+
# %2$S is the type of directive used by the resource (e.g. script-src)
57+
CSPROWasmEvalScriptViolation = (Report-Only policy) The page’s settings would block WebAssembly (%2$S) from being executed because it violates the following directive: “%1$S” (Missing 'wasm-unsafe-eval' or 'unsafe-eval')
58+
# LOCALIZATION NOTE (CSPStyleViolation):
59+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
960
# %2$S is the URI of the resource which violated the directive.
10-
CSPViolationWithURI = The page’s settings blocked the loading of a resource at %2$S (“%1$S”).
11-
# LOCALIZATION NOTE (CSPROViolationWithURI):
12-
# %1$S is the directive that has been violated.
61+
# %3$S is the type of directive used by the resource (e.g. style-src)
62+
CSPStyleViolation = The page’s settings blocked a style (%3$S) at %2$S from being applied because it violates the following directive: “%1$S”
63+
# LOCALIZATION NOTE (CSPROStyleViolation):
64+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
65+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
1366
# %2$S is the URI of the resource which violated the directive.
14-
CSPROViolationWithURI = The page’s settings observed the loading of a resource at %2$S (“%1$S”). A CSP report is being sent.
67+
# %3$S is the type of directive used by the resource (e.g. style-src)
68+
CSPROStyleViolation = (Report-Only policy) The page’s settings would block a style (%3$S) at %2$S from being applied because it violates the following directive: “%1$S”
69+
# LOCALIZATION NOTE (CSPScriptViolation):
70+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
71+
# %2$S is the URI of the resource which violated the directive.
72+
# %3$S is the type of directive used by the resource (e.g. script-src-elem)
73+
CSPScriptViolation = The page’s settings blocked a script (%3$S) at %2$S from being executed because it violates the following directive: “%1$S”
74+
# LOCALIZATION NOTE (CSPROScriptViolation):
75+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
76+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
77+
# %2$S is the URI of the resource which violated the directive.
78+
# %3$S is the type of directive used by the resource (e.g. script-src-elem)
79+
CSPROScriptViolation = (Report-Only policy) The page’s settings would block a script (%3$S) at %2$S from being executed because it violates the following directive: “%1$S”
80+
# LOCALIZATION NOTE (CSPWorkerViolation):
81+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
82+
# %2$S is the URI of the resource which violated the directive.
83+
# %3$S is the type of directive used by the resource (e.g. worker-src)
84+
CSPWorkerViolation = The page’s settings blocked a worker script (%3$S) at %2$S from being executed because it violates the following directive: “%1$S”
85+
# LOCALIZATION NOTE (CSPROWorkerViolation):
86+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
87+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
88+
# %2$S is the URI of the resource which violated the directive.
89+
# %3$S is the type of directive used by the resource (e.g. worker-src)
90+
CSPROWorkerViolation = (Report-Only policy) The page’s settings would block a worker script (%3$S) at %2$S from being executed because it violates the following directive: “%1$S”
91+
# LOCALIZATION NOTE (CSPGenericViolation):
92+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
93+
# %2$S is the URI of the resource which violated the directive.
94+
# %3$S is the type of directive used by the resource (e.g. image-src)
95+
CSPGenericViolation = The page’s settings blocked the loading of a resource (%3$S) at %2$S because it violates the following directive: “%1$S”
96+
# LOCALIZATION NOTE (CSPROGenericViolation):
97+
# Don't translate "Report-Only" as it's part of the name Content-Security-Policy-Report-Only.
98+
# %1$S is the entire directive that has been violated. (e.g. "default-src 'none'")
99+
# %2$S is the URI of the resource which violated the directive.
100+
# %3$S is the type of directive used by the resource (e.g. image-src)
101+
CSPROGenericViolation = (Report-Only policy) The page’s settings would block the loading of a resource (%3$S) at %2$S because it violates the following directive: “%1$S”
102+
15103
# LOCALIZATION NOTE (triedToSendReport):
16104
# %1$S is the URI we attempted to send a report to.
17105
triedToSendReport = Tried to send report to invalid URI: “%1$S”

0 commit comments

Comments
 (0)