Issue 8103008: Add content-security-policy directive to chrome://hung-renderer. WebUI pages should specify CSP ...

Issue 8103008: Add content-security-policy directive to chrome://hung-renderer. WebUI pages should specify CSP ... (Closed)

Created:
9 years, 2 months ago by Tom Sepez

Modified:
9 years, 2 months ago

Reviewers:
Evan Stade, abarth-chromium

CC:
chromium-reviews, arv (Not doing code reviews)

Base URL:
svn://svn.chromium.org/chrome/trunk/src/

Visibility:
Public.

Description

Add content-security-policy directive to chrome://hung-renderer. WebUI pages should specify CSP as a second line of defense against XSS vulnerabilities. Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=103727

Patch Set 1 #

Patch Set 2 : '' #

Created: 9 years, 2 months ago

Download [raw] [tar.bz2]

		Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+4 lines, -3 lines)			Patch
	M	chrome/browser/browser_resources.grd	View		1 chunk	+1 line, -1 line	0 comments	Download
	M	chrome/browser/resources/hung_renderer_dialog.html	View	1	1 chunk	+3 lines, -2 lines	0 comments	Download

Messages

Total messages: 3 (0 generated)

Expand Messages | Collapse Messages

abarth-chromium

LGTM. Can we switch this to a whitelist of pages that don't have the policy? ...

9 years, 2 months ago (2011-10-01 01:03:02 UTC) #2

LGTM.

Can we switch this to a whitelist of pages that don't have the policy?
 For example, instead of using the meta tag, we can include it as an
"http" header with all "chrome" URL request handlers.

Adam


On Fri, Sep 30, 2011 at 2:11 PM,  <tsepez@chromium.org> wrote:
> Reviewers: abarth, Evan Stade,
>
> Message:
> Found another one that crept its way in ...
>
> Description:
> Add content-security-policy directive to chrome://hung-renderer.  WebUI
> pages
> should specify CSP as a second line of defense against XSS vulnerabilities.
>
> Please review this at http://codereview.chromium.org/8103008/
>
> SVN Base: svn://svn.chromium.org/chrome/trunk/src/
>
> Affected files:
>  M     chrome/browser/browser_resources.grd
>  M     chrome/browser/resources/hung_renderer_dialog.html
>
>
> Index: chrome/browser/browser_resources.grd
> ===================================================================
> --- chrome/browser/browser_resources.grd        (revision 103541)
> +++ chrome/browser/browser_resources.grd        (working copy)
> @@ -42,7 +42,7 @@
>       <include name="IDR_CREDITS_JS" file="resources\about_credits.js"
> type="BINDATA" />
>       <include name="IDR_DOWNLOADS_JS" file="resources\downloads.js"
> type="BINDATA" />
>       <include name="IDR_DOWNLOADS_HTML" file="resources\downloads.html"
> flattenhtml="true" allowexternalscript="true" type="BINDATA" />
> -      <include name="IDR_HUNG_RENDERER_DIALOG_HTML"
> file="resources\hung_renderer_dialog.html" type="BINDATA" />
> +      <include name="IDR_HUNG_RENDERER_DIALOG_HTML"
> file="resources\hung_renderer_dialog.html" flattenhtml="true"
> allowexternalscript="true" type="BINDATA" />
>       <include name="IDR_HUNG_RENDERER_DIALOG_JS"
> file="resources\hung_renderer_dialog.js" type="BINDATA" />
>       <include name="IDR_HUNG_RENDERER_DIALOG_CSS"
> file="resources\hung_renderer_dialog.css" type="BINDATA" />
>       <include name="IDR_TASK_MANAGER_HTML"
> file="resources\task_manager\main.html" flattenhtml="true"
> allowexternalscript="true" type="BINDATA" />
> Index: chrome/browser/resources/hung_renderer_dialog.html
> ===================================================================
> --- chrome/browser/resources/hung_renderer_dialog.html  (revision 103537)
> +++ chrome/browser/resources/hung_renderer_dialog.html  (working copy)
> @@ -3,6 +3,7 @@
>   <head>
>     <meta charset="utf-8">
>     <title i18n-content="title"></title>
> +    <include src="content_security_policy.html"/>
>     <link rel="stylesheet" href="hung_renderer_dialog.css">
>     <link rel="stylesheet" href="chrome://resources/css/button.css">
>     <link rel="stylesheet" href="chrome://resources/css/chrome_shared.css">
>
>
>

I'll file a bug for moving to the "real" header.  Tx.

Expand Messages | Collapse Messages