Skip to content

[adblock] Incorrect 1p/3p check for CSP rules #57625

Description

@atuchin-m

The problem: Rules like $~third-party,csp=... does not apply after a cross-site main-frame navigation.
We uses the previous page as the initiator, so the destination looks third-party.

Steps

  1. Make custom filter: ||iana.org^$~third-party,csp=script-src 'none'
  2. Open https://example.com/
  3. Click on the link https://iana.org/domains/example

Expected: CSP injected on iana.org (the scripts are blocked, Loading the script 'https://www.iana.org/static/js/jquery.a8e7cabd4d49.js' violates the following Content Security Policy directive: "script-src 'none'" in devtools)
Actual: rule skipped; page loads without that CSP.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions