Bug 2055516

[dklawren]

Carried of r+ from private pull request
https://bugzilla.mozilla.org/show_bug.cgi?id=2055516

[Copilot]

Pull request overview

Advances the CSP enforcement rollout by collecting violations, controlling enforcement for legacy CGI pages, and removing inline handlers.

Changes:

• Adds a rate-limited CSP report collector with structured logging.
• Introduces CGI enforcement controls and preserves modal bug-view enforcement.
• Converts inline handlers to nonce-protected listeners and adds CSP tests.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
template/en/default/bug/edit.html.tmpl	Makes bug editing CSP-compatible.
template/en/default/bug/create/create.html.tmpl	Makes bug creation CSP-compatible.
t/csp-report.t	Tests report collection and sanitization.
t/csp-enforce.t	Tests CSP enforcement selection.
show_bug.cgi	Explicitly enforces CSP for modal views.
Bugzilla/Constants.pm	Adds reporting and CGI allowlist policy.
Bugzilla/Config/Admin.pm	Configures collector rate limits.
Bugzilla/App/Plugin/Glue.pm	Selects report-only or enforcing headers.
Bugzilla/App/Controller/CSPReport.pm	Implements the violation collector.

Suppressed comments (1)

template/en/default/bug/edit.html.tmpl:47

• This anchor is presented as a button, but it does not implement the Space-key behavior expected from that role, and x is not a descriptive accessible name. A native button preserves the existing click listener while providing correct keyboard semantics.

      <a href="#" id="bz_ctag_hide_error" role="button">x</a>

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.