[iOS] [hackerone] Make sure original document security settings apply to Reader Mode

[stoletheminerals]

Reader mode sends pre-defined security headers. This may cause security issues if the original page has a stricter policy.
More details: #35797

[diracdeltas]

CSP

iOS sets a CSP header here that is already very restrictive: https://github.com/brave/brave-ios/blob/cc0db0c0a920868087167c2e397d77d756ec66a1/Sources/Brave/Frontend/Browser/Handlers/ReaderModeHandler.swift#L73. However we should lock it down further to this:

default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; sandbox; upgrade-insecure-requests; img-src *; style-src \(InternalURL.baseUrl) '\(ReaderModeHandler.readerModeStyleHash)'; font-src \(InternalURL.baseUrl); script-src 'nonce-\(setTitleNonce)'"]

sandbox is most likely to break something, if that is the case we can loosen it.

In addition, if we detect that the page sets img-src in CSP via either an HTTP header or a meta element, we should apply that policy instead of img-src *. Note that if you send a second CSP header or add it as a meta element, it overrides img-src * because the most restrictive policy should be applied automatically.

Subresource Integrity

for https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity, we need to make sure the HTML integrity and crossorigin attributes from the original page are preserved in the reader mode page on all elements.

Non-CSP headers

In addition to modifying the CSP, the reader mode HTTP response should set a few more security headers in https://github.com/brave/brave-ios/blob/cc0db0c0a920868087167c2e397d77d756ec66a1/Sources/Brave/Frontend/Browser/Handlers/ReaderModeHandler.swift#L69

Namely:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy:  no-referrer

[iccub]

transferred to brave-browser repo

[hffvld]

Verified on iPhone 14 using version(s):

Device/OS: iPhone 14 / iOS 17.5.1
Brave build: 1.67 (118)
BraveCore: 1.67.118 (126.0.6478.71)

---

STEPS:

1. Launch Brave
2. Go to https://js176.gitlab.io/tools/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension
3. Three-dot menu > Settings > Appearance
4. Enable Speedreader > Verify

ACTUAL RESULTS:

• Verified that Speedreader-enabled view rendered, without the image, as per the test plan

---

1	2