From 94bfd04bf58c052951ae7a834b6f42df7338ca5a Mon Sep 17 00:00:00 2001
From: Danil Somsikov <[email protected]>
Date: Wed, 11 Mar 2026 08:56:45 -0700
Subject: [PATCH] Prevent CSP bypass in source map fetches via removed frames

Currently, DevTools only blocks its unsafe fallback mechanism for
source map requests if it receives a literal "CSP violation" error
from the target. An attacker can bypass this by triggering a fetch
from an injected iframe and immediately removing it. This causes the
primary load to fail with a "Frame not found" error, which
incorrectly triggers the fallback and bypasses the page's Content
Security Policy.

This CL addresses the issue by querying the frame's security posture
(via `Network.getSecurityIsolationStatus`) before initiating the fetch.
If a restrictive CSP (`connect-src` or `default-src`) is detected,
any failure from the target load is treated as a terminal security
failure, preventing the unsafe fallback mechanism from executing.

Bug: 490773579
Change-Id: I7293ba2f112a9cd4ab765dce6de8439afbb0f1b5
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7656988
Commit-Queue: Simon Zünd <[email protected]>
Auto-Submit: Danil Somsikov <[email protected]>
Commit-Queue: Danil Somsikov <[email protected]>
Reviewed-by: Simon Zünd <[email protected]>
---
diff --git a/front_end/core/sdk/PageResourceLoader.test.ts b/front_end/core/sdk/PageResourceLoader.test.ts
index cba13d6..a5bcb8c 100644
--- a/front_end/core/sdk/PageResourceLoader.test.ts
+++ b/front_end/core/sdk/PageResourceLoader.test.ts
@@ -295,6 +295,94 @@
       });
     }
   });
+
+  describe('loadResource with CSP', () => {
+    it('does not fall back to host bindings if frame has restrictive CSP', async () => {
+      const {loader, settings, targetManager} = setup();
+      settings.moduleSetting('cache-disabled').set(false);
+      const connection = new MockCDPConnection();
+
+      connection.setHandler('Network.getSecurityIsolationStatus', () => {
+        return {
+          result: {
+            status: {
+              csp: [{
+                effectiveDirectives: 'connect-src \'none\'',
+                isEnforced: true,
+                source: 'HTTP' as Protocol.Network.ContentSecurityPolicySource,
+              }],
+            },
+          },
+        };
+      });
+
+      connection.setHandler('Network.loadNetworkResource', () => {
+        return {
+          error: {
+            code: -32000,
+            message: 'Frame not found',
+          },
+        };
+      });
+
+      const target = createTarget({connection, targetManager});
+      const initiator = {target, frameId: '123' as Protocol.Page.FrameId, initiatorUrl: urlString`https://example.com`};
+      const url = urlString`https://example.com/source.map`;
+
+      const loadHostBindingsStub =
+          sinon.stub(Host.InspectorFrontendHost.InspectorFrontendHostInstance, 'loadNetworkResource');
+
+      try {
+        await loader.loadResource(url, initiator);
+        assert.fail('Expected loadResource to throw');
+      } catch (e) {
+        assert.strictEqual(e.message, 'Frame not found');
+      }
+
+      // Verify fallback was NOT called
+      sinon.assert.notCalled(loadHostBindingsStub);
+    });
+
+    it('falls back to host bindings if frame has no restrictive CSP', async () => {
+      const {loader, settings, targetManager} = setup();
+      settings.moduleSetting('cache-disabled').set(false);
+      const connection = new MockCDPConnection();
+
+      connection.setHandler('Network.getSecurityIsolationStatus', () => {
+        return {
+          result: {
+            status: {
+              csp: [],
+            },
+          },
+        };
+      });
+
+      connection.setHandler('Network.loadNetworkResource', () => {
+        return {
+          error: {
+            code: -32000,
+            message: 'Frame not found',
+          },
+        };
+      });
+
+      const target = createTarget({connection, targetManager});
+      const initiator = {target, frameId: '123' as Protocol.Page.FrameId, initiatorUrl: urlString`https://example.com`};
+      const url = urlString`https://example.com/source.map`;
+
+      const loadHostBindingsStub =
+          sinon.stub(Host.InspectorFrontendHost.InspectorFrontendHostInstance, 'loadNetworkResource')
+              .callsFake((_url, _headers, streamId, callback) => {
+                Host.ResourceLoader.streamWrite(streamId, 'fallback content');
+                callback({statusCode: 200});
+              });
+
+      const result = await loader.loadResource(url, initiator);
+      assert.strictEqual(result.content, 'fallback content');
+      sinon.assert.calledOnce(loadHostBindingsStub);
+    });
+  });
 });
 
 describe('PageResourceLoader', () => {
diff --git a/front_end/core/sdk/PageResourceLoader.ts b/front_end/core/sdk/PageResourceLoader.ts
index bf4335c..6439842 100644
--- a/front_end/core/sdk/PageResourceLoader.ts
+++ b/front_end/core/sdk/PageResourceLoader.ts
@@ -334,6 +334,27 @@
         initiator.target;
     Host.userMetrics.developerResourceScheme(this.getDeveloperResourceScheme(parsedURL));
     if (eligibleForLoadFromTarget) {
+      let mustEnforceCSP = false;
+      const isHttp = parsedURL.scheme === 'http' || parsedURL.scheme === 'https';
+      if (isHttp && initiator.target) {
+        const networkManager = initiator.target.model(NetworkManager);
+        if (networkManager) {
+          let status = await networkManager.getSecurityIsolationStatus(initiator.frameId);
+          if (!status && initiator.frameId) {
+            status = await networkManager.getSecurityIsolationStatus(null);
+          }
+          if (status?.csp) {
+            for (const csp of status.csp) {
+              const directives = csp.effectiveDirectives;
+              if (directives.includes('connect-src') || directives.includes('default-src')) {
+                mustEnforceCSP = true;
+                break;
+              }
+            }
+          }
+        }
+      }
+
       try {
         Host.userMetrics.developerResourceLoaded(Host.UserMetrics.DeveloperResourceLoaded.LOAD_THROUGH_PAGE_VIA_TARGET);
         const result = await this.loadFromTarget(initiator.target, initiator.frameId, url, isBinary);
@@ -341,7 +362,7 @@
       } catch (e) {
         if (e instanceof Error) {
           Host.userMetrics.developerResourceLoaded(Host.UserMetrics.DeveloperResourceLoaded.LOAD_THROUGH_PAGE_FAILURE);
-          if (e.message.includes('CSP violation')) {
+          if (mustEnforceCSP || e.message.includes('CSP violation')) {
             return {
               success: false,
               content: '',