Make sure original document security settings apply to speedreader document

[diracdeltas]

probably the HTTP headers are already preserved but we should check:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (both the HTTP header and the meta HTML tag)
• https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity (note this is an HTML attribute not a header)
• Access-Control-Allow-Origin header https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
• Potentially other headers listed in https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

References:
https://hackerone.com/bugs?subject=brave&report_id=2354284&view=new&substates%5B%5D=new&reported_to_team=&text_query=&program_states%5B%5D=2&program_states%5B%5D=3&program_states%5B%5D=4&program_states%5B%5D=5&sort_type=latest_activity&sort_direction=descending&limit=25&page=1
#35095

[iefremov]

@diracdeltas we do not modify the original headers, but in fact they can be painful for us, see #24577

[diracdeltas]

Discussed on Slack what to do:

1. HTML tags with the http-equiv attribute from the original page should be inserted in the speedreader page. However for the content security policy meta tag, we need to make sure the style src directive does not overwrite the speedreader stylesheets. Therefore if a page defines <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'"> this needs to make sure our style-src takes precedence but default-src none applies to everything else. Or alternatively we can start with a more restrictive policy and only allow the page to loosen it for things like images that speedreader needs to load - see https://bravesoftware.slack.com/archives/C6R461GF4/p1707157012700929?thread_ts=1707059179.689489&cid=C6R461GF4
2. As @iefremov noted, we don't modify headers so no security issues there, but there is this problem where the page CSP header can overwrite the speedreader CSP meta tag: Page CSP can block Reader Mode stylesheet #24577. perhaps whatever solution we apply from Item 1 for CSP meta tags we can also apply for the CSP HTTP headers. note however some CSP directives like frame-ancestors and sandbox can ONLY be applied via HTTP header, not a meta tag, so those should be always preserved.
3. For https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity, it seems we can in fact delete the subresource integrity attributes which is a security problem. So we need to make sure when distilling HTML for speedreader that the HTML integrity and crossorigin attributes from the original page are preserved in the speedreader page. Test case: https://googlechrome.github.io/samples/subresource-integrity/ (the stylesheet won't render regardless but you can inspect the HTML in speedreader mode to check whether these attributes are preserved).

[boocmp]

Only these artributes are removed during the distillation process, the rest remain as in the original page, but we completely remove all < links > and <script> elements, so I assume we should check if there are no elements with integrity attributes, instead of checking they are preserved.

[diracdeltas]

Only these artributes are removed during the distillation process, the rest remain as in the original page, but we completely remove all < links > and <script> elements, so I assume we should check if there are no elements with integrity attributes, instead of checking they are preserved.

Since the CSP disables script I think we are fine to remove script elements. As for link, if we allow loading of some elements like favicon, we should make sure the integrity attributes are kept. However if we block all loading from link elements as we do for stylesheets, it's also fine to remove completely.

[stephendonner]

Verified PASSED using

Brave | 1.64.81 Chromium: 122.0.6261.43 (Official Build) beta (x86_64)
-- | --
Revision | 19b9ce86d7aed2a1fdb7734d6a27f2fe6abd0153
OS | macOS Version 14.4 (Build 23E5205c)

#35797 - PASSED

Steps:

1. installed 1.64.81
2. launched Brave
3. loaded https://js176.gitlab.io/tools/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension
4. clicked on Turn on Speedreader

Confirmed Speedreader-enabled view rendered, with This image is not loaded showing, as per the testplan

example	example

#24577 - Already verified: #24577 (comment)

[btlechowski]

Verified with

Brave	1.64.91 Chromium: 122.0.6261.94 (Official Build) beta (64-bit)
Revision	939586e20d208404b83713ea05cf5f6fa7fe3dd5
OS	Linux

Verified test plan from brave/brave-core#21958

First issue

Second issue

[hffvld]

Verified on Galaxy Tab S8 and Pixel 7 using version(s):

Device/OS: 
- Galaxy Tab S8 / gts8wifixx-user 14 UP1A.231005.007 release-keys
- Pixel 7 / panther_beta-user 14 AP21.240119.009 release-keys
Brave build: 1.64.95 
Chromium: 122.0.6261.94 (Official Build) beta (64-bit) 

---

First issue

STEPS:

1. Launch Brave
2. Go to https://js176.gitlab.io/tools/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension
3. Three-dot menu > Settings > Appearance
4. Enable Speedreader > Verify

ACTUAL RESULTS:

• Verified that Speedreader-enabled view rendered, with This image is not loaded shown, as per the test plan

---

Galaxy Tab S8 / Tablet

1	2

Pixel 7 / Phone

1	2

Second issue

STEPS:

1. Launch Brave
2. Go to https://seirdy.one/posts/ > Open some articles
3. Three-dot menu > Settings > Appearance
4. Enable Speedreader > Verify that the CSS for reader mode is applied

ACTUAL RESULTS:

• Verified that the CSS for Speedreader mode is applied, as per the test plan

---

Galaxy Tab S8 / Tablet

1	2

Pixel 7 / Phone

1	2

[stephendonner]

Verified PASSED using

Brave | 1.64.97 Chromium: 122.0.6261.111 (Official Build) beta (64-bit)
-- | --
Revision | f7c8f13563bfe1063db456650cb43207e1c960c0
OS | Windows 10 Version 22H2 (Build 19045.4123)

First issue #35797 - PASSED

Steps:

1. installed 1.64.97
2. launched Brave
3. loaded https://js176.gitlab.io/tools/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension
4. clicked on Turn on Speedreader

Confirmed Speedreader mode worked

example	example

Second issue: #24577 - PASSED

Steps:

1. installed 1.64.97
2. launched Brave
3. loaded an archived blog post from https://seirdy.one/
4. opened the Console in DevTools
5. clicked on Turn on Speedreader

Confirmed Speedreader mode worked

example	example