Inline scripts are not "seen"

[skriptimaahinen]

NS: 10.1.8.1

As title states, inline scripts do not get the red marker for blocked script in the CUSTOM tab (or get counted in the badge).

Problem seems to be in RequestGuard.js:onViolationReport, which appears not to detect and handle properly the CSP violation inline scripts throw.

[skriptimaahinen]

Something like this should do it:

RequestGuard.js/onViolationReport:525

Code: Select all

} else if (report["violated-directive"] === "script-src" && /; script-src 'none'/.test(report["original-policy"])) {
  let r =  fakeRequestFromCSP(report, request);
  Content.reportTo(r, false, "script"); // NEW
  TabStatus.record(r, "noscriptFrame", true);
}

Of course since the detection is based on CSP report, once the script has been enabled and page reloaded, there won't be CSP report anymore and the "seen" marker disappears, which also might confuse those trying to get "maximum granularity".

[Giorgio Maone]

Fixed here, thanks