SecurityEngineering/CSP Radar: Difference between revisions
(→Bugs) |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 28: | Line 28: | ||
* P? - (non CSP spec) - script-hash ? | * P? - (non CSP spec) - script-hash ? | ||
= | = Things To Do ? = | ||
* script-nonce / script-hash (CSP 1.1) | * script-nonce / script-hash (CSP 1.1) | ||
* paths (CSP 1.1) | * paths (CSP 1.1) | ||
| Line 38: | Line 34: | ||
* anything else from CSP 1.1 or UI Safety specs ? | * anything else from CSP 1.1 or UI Safety specs ? | ||
* frame-options (pretty much == frame-ancestors) | * frame-options (pretty much == frame-ancestors) | ||
* redirects / general nsIContentPolicy issue ? | * redirects / general nsIContentPolicy issue ? | ||
= ACTIONS = | = ACTIONS = | ||
* figure out if W3C test suite failures are legit - file bugs for the failures that are | * figure out if W3C test suite failures are legit - file bugs for the failures that are | ||
** Brad Hill test suite: http://webappsec-test.info/web-platform-tests/CSP/ | ** Brad Hill test suite: http://webappsec-test.info/web-platform-tests/CSP/ | ||
* needs confirmation - Verify that content added by XSLT stylesheet is subject to document's CSP - https://bugzilla.mozilla.org/show_bug.cgi?id=663567 | * needs confirmation - Verify that content added by XSLT stylesheet is subject to document's CSP - https://bugzilla.mozilla.org/show_bug.cgi?id=663567 | ||
* needs confirmation - EventSource needs to be restricted using connect-src directive https://bugzilla.mozilla.org/show_bug.cgi?id=802872 - test to make sure it isn't already | |||
Latest revision as of 01:30, 29 June 2013
CSP: the Future™
- 1.0 support is in Fx23 which will go to Release on August 6, 2013
- bugs that affect CSP 1.0 support should be dependencies for https://bugzilla.mozilla.org/show_bug.cgi?id=663566
Bugs
- P0 - CSP 1.0 turned on for Firefox OS - https://bugzilla.mozilla.org/show_bug.cgi?id=858787 (assign=grobinson)
- grobinson has spent some time on this and discovered some other blocking bugs that he has fixed or is fixing
- P1 (CSP 1.0) A policy of like script-src 'self' 'unsafe-inline'; allows eval but should not https://bugzilla.mozilla.org/show_bug.cgi?id=882060 (assign=sid)
- P1 - (CSP 1.0) CSP should not block inline scripts or eval unless script-src or default-src are included - https://bugzilla.mozilla.org/show_bug.cgi?id=885433 (assign=grobinson)
- P2 - (CSP 1.0) report destination loosening - https://bugzilla.mozilla.org/show_bug.cgi?id=843311 - helps adoption but isn't crucial
- P2 - (CSP 1.0) EventSource needs to be restricted using connect-src directive https://bugzilla.mozilla.org/show_bug.cgi?id=802872
- needs to be tested to make sure it isn't already
- P2 - (CSP 1.0) Verify that content added by XSLT stylesheet is subject to document's CSP - https://bugzilla.mozilla.org/show_bug.cgi?id=663567
- needs someone to test it
- P2 - redirects / nsIContentPolicy - test cases involving redirects fail for some reason
- P2 - (CSP 1.1) - script-nonce (helps with adoption) - land behind a pref, grobinson has written a patch for this
- P2 - improve error messages/logging - https://bugzilla.mozilla.org/show_bug.cgi?id=607067 https://bugzilla.mozilla.org/show_bug.cgi?id=792161
- P3 (spec unclear?) Content Security Policy (CSP) blocks SVG embedded as data URI in CSS url() (affects b2g) https://bugzilla.mozilla.org/show_bug.cgi?id=878608
- P3 - fix bookmarklets to work with CSP - https://bugzilla.mozilla.org/show_bug.cgi?id=866522
- P3 - (CSP 1.1) https://bugzilla.mozilla.org/show_bug.cgi?id=826805 - allow HTTPS content when an http source is present (in 1.1 spec)
- P3 - (CSP 1.1) meta support - many issues to resolve - https://bugzilla.mozilla.org/show_bug.cgi?id=663570
- P3 - (CSP 1.1) paths - https://bugzilla.mozilla.org/show_bug.cgi?id=808292
- P3 - C++ rewrite
- P3 - sandbox (depends on iframe sandbox work that isn't complete (needs allow-popups, bug 785310) - https://bugzilla.mozilla.org/show_bug.cgi?id=671389
- P4 (not in spec) block CSSOM calls without style-src: unsafe-eval https://bugzilla.mozilla.org/show_bug.cgi?id=873302 - needs proposal and discussion on the WG list
- P4 - (CSP 1.0) eval bypass using crypto.generateCRMFRequest https://bugzilla.mozilla.org/show_bug.cgi?id=824652 - can already run script in this case
- P4 (spec under development still) - frame options https://bugzilla.mozilla.org/show_bug.cgi?id=846978 (have existing frame-ancestors, going to fix X-Frame-Options - https://bugzilla.mozilla.org/show_bug.cgi?id=725490)
- P? - (non CSP spec) - script-hash ?
Things To Do ?
- script-nonce / script-hash (CSP 1.1)
- paths (CSP 1.1)
- sandbox (options 1.0, in csp1.1)
- anything else from CSP 1.1 or UI Safety specs ?
- frame-options (pretty much == frame-ancestors)
- redirects / general nsIContentPolicy issue ?
ACTIONS
- figure out if W3C test suite failures are legit - file bugs for the failures that are
- Brad Hill test suite: http://webappsec-test.info/web-platform-tests/CSP/
- needs confirmation - Verify that content added by XSLT stylesheet is subject to document's CSP - https://bugzilla.mozilla.org/show_bug.cgi?id=663567
- needs confirmation - EventSource needs to be restricted using connect-src directive https://bugzilla.mozilla.org/show_bug.cgi?id=802872 - test to make sure it isn't already