Handling of 'self' is unclear when inheriting CSP to local scheme

[shhnjk]

Spec requires inheriting CSP to local-scheme.
https://w3c.github.io/webappsec-csp/#initialize-document-csp

But it is not clear how to handle 'self' in this case.

PoC
https://test.shhnjk.com/local_scheme.html

Chrome takes 'self' as local-scheme itself. Where Firefox takes 'self' as embedding document's origin.

[annevk]

cc @ckerschb

[andypaicu]

I think if you were to follow the spec to the letter currently, the Chrome behavior is correct because the 'self' keyword only gets handled in here: https://w3c.github.io/webappsec-csp/#match-url-to-source-expression. This means that aliasing the policy won't magically keep 'self' locked to the embedder meaning of 'self'. I think Firefox actually expands 'self' into the origin when parsing the policy which would explain the different behaviour.

Edit: updating link to one that isn't pointing at my local file...

[annevk]

Yeah indeed, since a data: URL always computes to an opaque origin it can never be the same as that origin variable.

One arguably editorial bug here is that "same" is not a reference to "same origin". Definitely editorial is the inconsistent usage of trailing dots.

[annevk]

It would be good to have this covered in the test suite (and would also be good to have a bug against Firefox if none is filed already).

[shhnjk]

Bug filed for Firefox.
https://bugzilla.mozilla.org/show_bug.cgi?id=1410754

[dveditz]

An opaque origin doesn't even match itself, so if you interpret 'self' as meaning the data URL then it's a completely pointless directive in a data: url's CSP

By analogy, in a sandboxed iframe (effective origin is opaque) we still resolve relative URLs relative to the creating document. That's what Firefox is doing with our interpretation of 'self' and it's hard to see how that's wrong. At the very least it seems useful.

[shhnjk]

That's right. This is why I've opened issue 259 and 260.

[ckerschb]

"To answer this question: I think Firefox actually expands 'self' into the origin when parsing the policy which would explain the different behaviour."

That's correct, by the time the CSP Parser evaluates 'self' (within Firefox) it gets translated into the protected document's origin. If then that CSP gets inherited into a data: URI iframe, then the iframe inherits a CSP with the parent's protected document URI as 'self'.

[andypaicu]

#362