From 035b4f28275e671a61c3f922cce0d783a9079098 Mon Sep 17 00:00:00 2001
From: hackademix
Date: Thu, 7 Nov 2019 15:12:25 +0100
Subject: Fixed CSP DOM injection breaking XML documents rendering.

---
 src/content/DocumentCSP.js | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/src/content/DocumentCSP.js b/src/content/DocumentCSP.js
index ade9013..9991d4f 100644
--- a/src/content/DocumentCSP.js
+++ b/src/content/DocumentCSP.js
@@ -7,11 +7,20 @@ class DocumentCSP {
   }
 
   apply(capabilities, embedding = CSP.isEmbedType(this.document.contentType)) {
+    let {document} = this;
+    if (!(document instanceof HTMLDocument)) {
+      // this is not HTML, hence we cannot inject a <meta> CSP
+      if (!capabilites.has("script")) {
+        // safety net for XML (especially SVG) documents
+        document.defaultView.addEventListener("beforescriptexecute",
+          e => e.preventDefault(), true);
+      }
+      return false;
+    }
     let csp = this.builder;
     let blocker = csp.buildFromCapabilities(capabilities, embedding);
-    if (!blocker) return;
+    if (!blocker) return true;
 
-    let document = this.document;
     let createHTMLElement =
       tagName => document.createElementNS("http://www.w3.org/1999/xhtml", tagName);
 
@@ -19,18 +28,23 @@ class DocumentCSP {
     let meta = createHTMLElement("meta");
     meta.setAttribute("http-equiv", header.name);
     meta.setAttribute("content", header.value);
+    let root = document.documentElement;
     let {head} = document;
     let parent = head ||
-      document.documentElement.appendChild(createHTMLElement("head"));
+      (root instanceof HTMLElement
+        ? document.documentElement.appendChild(createHTMLElement("head"))
+        : root);
 
     try {
-      parent.insertBefore(meta, parent.firstChild);
+      parent.insertBefore(meta, parent.firstElementChild);
       debug(`Failsafe <meta> CSP inserted in %s: "%s"`, document.URL, header.value);
       meta.remove();
       if (!head) parent.remove();
     } catch (e) {
       error(e, "Error inserting CSP %s in %s", document.URL, header && header.value);
+      return false;
     }
+    return true;
   }
 
 }
-- 
cgit v1.2.3