Intent to ship: CSP Violation DOM Events

[Chung-Sheng Fu]

Content Security Policy suggests Security Policy Violation DOM Events [1].
In case any of the directives within a policy are violated, such a
SecurityPolicyViolationEvent is generated and sent out to a reporting
endpoint associated with the policy. We are working on implementing those
violation events here [2] and plan to ship them within Firefox 59.

Thanks,

Chung-Sheng Fu, Christoph Kerschbaumer

[1] https://w3c.github.io/webappsec-csp/#violation-events

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1037335

[James Graham]

On 17/11/17 05:55, Chung-Sheng Fu wrote:
> Content Security Policy suggests Security Policy Violation DOM Events [1].
> In case any of the directives within a policy are violated, such a
> SecurityPolicyViolationEvent is generated and sent out to a reporting
> endpoint associated with the policy. We are working on implementing those
> violation events here [2] and plan to ship them within Firefox 59.

Do we have cross-browser (i.e. web-platform) tests covering this feature?

[Ethan Tseng]

On Fri, Nov 17, 2017 at 6:01 PM, James Graham <ja...@hoppipolla.co.uk>
wrote:

Yes we do.
The web-platform tests are in the folder
testing/web-platform/meta/content-security-policy/.
Bug 1037335 <https://bugzilla.mozilla.org/show_bug.cgi?id=1037335> added
several tests for this feature and modified a bunch of tests to make them
fit in it.


- Ethan Tseng

[Daniel Veditz]

On Fri, Nov 17, 2017 at 2:01 AM, James Graham <ja...@hoppipolla.co.uk>
wrote:

> Do we have cross-browser (i.e. web-platform) tests covering this feature?

We fail many of the existing CSP web platform tests, despite having
implemented most of the features, because they were written to use the
violation events to check the results.​

[smaug]

Looks like there are quite a few spec issues still. Probably better to get those fixed first and then
update our implementation.

[James Graham]

Is that an issue with our implementation or something we should fix in
the tests? In either case it seems problematic to have such a feature
and no way of checking for compatibility with other implementations.

[amarc...@mozilla.com]

I'm going to enable CSP Violation Events by default in Firefox 63. Bug 1432523.

I and ckerschb have done a good job to make our code compliant with the latest CSP3 spec and we pass (almost) all the related WPT tests.

The only remaining bit is related to <iframe src="javascript:foo"/> (bug 1473630) but we decided to work on it as follow up.