153168 2016-01-15 18:10:04 -0800 CSP: Disallow an empty host in a host-source source expression 2016-02-16 13:16:18 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Local Build All All RESOLVED FIXED BlinkMergeCandidate, InRadar P2 Normal --- 153170 1 dbates dbates bfulgham commit-queue mkwst webkit-bug-importer oldest_to_newest 1156064 0 dbates 2016-01-15 18:10:04 -0800 We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=180407>. Disallow an empty host in a CSP host-source directive Currently "https://" is accepted and treated like "https:". This behavior has never been part of any standard. The syntax is specified in http://www.w3.org/TR/CSP11/#source-list-syntax host-source = [ scheme-part "://" ] host-part [ port-part ] [ path-part ] host-part = "*" / [ "*." ] 1*host-char *( "." 1*host-char ) As you can see, the host-part is NOT optional. 1159620 1 webkit-bug-importer 2016-01-27 20:59:42 -0800 <rdar://problem/24383366> 1165237 2 271461 dbates 2016-02-16 11:51:04 -0800 Created attachment 271461 Patch 1165261 3 271461 bfulgham 2016-02-16 12:28:32 -0800 Comment on attachment 271461 Patch r=me. 1165284 4 dbates 2016-02-16 13:16:18 -0800 Committed r196653: <http://trac.webkit.org/changeset/196653> 271461 2016-02-16 11:51:04 -0800 2016-02-16 12:28:32 -0800 Patch bug-153168-20160216115044.patch text/plain 3436 dbates U3VidmVyc2lvbiBSZXZpc2lvbjogMTk2NjE0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNGEzY2E2ZjQ5YWRlOTY3 MDZlNzI2N2ZjMGI4ZWVhZTFiMzE1NjdiYS4uYjhkNWZlYjYyZTdhMTU2MDY3MWQ4NDhlMmEzMjdh NWMyNWMzYTUxMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE2LTAyLTE2ICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKworICAgICAgICBEaXNhbGxvdyBhbiBlbXB0 eSBob3N0IGluIGEgQ1NQIGhvc3Qtc291cmNlIGRpcmVjdGl2ZQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUzMTY4CisgICAgICAgIDxyZGFyOi8vcHJv YmxlbS8yNDM4MzM2Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBNZXJnZWQgZnJvbSBCbGluayAocGF0Y2ggYnkgcm9iQHJvYnd1Lm5sKToKKyAgICAg ICAgPGh0dHBzOi8vc3JjLmNocm9taXVtLm9yZy92aWV3dmMvYmxpbms/cmV2aXNpb249MTgwNDA3 JnZpZXc9cmV2aXNpb24+CisKKyAgICAgICAgKiBwYWdlL2NzcC9Db250ZW50U2VjdXJpdHlQb2xp Y3lTb3VyY2VMaXN0LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNvbnRlbnRTZWN1cml0eVBvbGlj eVNvdXJjZUxpc3Q6OnBhcnNlU291cmNlKToKKwogMjAxNi0wMi0xNSAgU2FtIFdlaW5pZyAgPHNh bUB3ZWJraXQub3JnPgogCiAgICAgICAgIFN0b3AgdXNpbmcgTlNNYXBUYWJsZSBpbiBwbGFjZXMg d2hlcmUgd2Ugd2VyZSBvbmx5IHVzaW5nIGl0IHRvIGJlIEdDIHNhZmUKZGlmZiAtLWdpdCBhL1Nv dXJjZS9XZWJDb3JlL3BhZ2UvY3NwL0NvbnRlbnRTZWN1cml0eVBvbGljeVNvdXJjZUxpc3QuY3Bw IGIvU291cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5U291cmNlTGlz dC5jcHAKaW5kZXggYTgwZTdlOGRjZTIyN2Q3N2Y2ZDM4ZWIyNWUyMDdiOWUzOTM0YjE1OS4uYmE1 YjM0MTdjMGU0Mjc0NDVmYjViOTI1NjZjNjQyZTI2Zjc4Y2NmMSAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5U291cmNlTGlzdC5jcHAKKysr IGIvU291cmNlL1dlYkNvcmUvcGFnZS9jc3AvQ29udGVudFNlY3VyaXR5UG9saWN5U291cmNlTGlz dC5jcHAKQEAgLTIyMSw3ICsyMjEsNyBAQCBib29sIENvbnRlbnRTZWN1cml0eVBvbGljeVNvdXJj ZUxpc3Q6OnBhcnNlU291cmNlKGNvbnN0IFVDaGFyKiBiZWdpbiwgY29uc3QgVUNoYQogICAgICAg ICAgICAgICAgIHx8ICFza2lwRXhhY3RseTxVQ2hhcj4ocG9zaXRpb24sIGVuZCwgJy8nKSkKICAg ICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgICAgICAgICBpZiAocG9zaXRpb24gPT0g ZW5kKQotICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOworICAgICAgICAgICAgICAgIHJldHVy biBmYWxzZTsKICAgICAgICAgICAgIGJlZ2luSG9zdCA9IHBvc2l0aW9uOwogICAgICAgICAgICAg c2tpcFdoaWxlPFVDaGFyLCBpc05vdENvbG9uT3JTbGFzaD4ocG9zaXRpb24sIGVuZCk7CiAgICAg ICAgIH0KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0No YW5nZUxvZwppbmRleCBmMmM0NzU4ZTQxNWY3NmI5NWYwMTJkOWY1ODg0MTc2Y2IyZWQxOTc4Li5i OGQ4YjlmYjAyNGMzNTJmNDljNTVhNjBjMmNlYWEwYzk4YzJhODVhIDEwMDY0NAotLS0gYS9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEs MTYgQEAKKzIwMTYtMDItMTYgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUuY29tPgorCisg ICAgICAgIERpc2FsbG93IGFuIGVtcHR5IGhvc3QgaW4gYSBDU1AgaG9zdC1zb3VyY2UgZGlyZWN0 aXZlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTMx NjgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI0MzgzMzY2PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJlbW92ZSBlbnRyeSBmb3IgdGVzdCBodHRw L3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS9zb3VyY2UtbGlzdC1wYXJzaW5n LTA3Lmh0bWwKKyAgICAgICAgYXMgaXQgbm93IHBhc3Nlcy4KKworICAgICAgICAqIFRlc3RFeHBl Y3RhdGlvbnM6CisKIDIwMTYtMDItMTUgIFJ5YW4gSGFkZGFkICA8cnlhbmhhZGRhZEBhcHBsZS5j b20+CiAKICAgICAgICAgUmViYXNlbGluZSBpbXBvcnRlZC93M2Mvd2ViLXBsYXRmb3JtLXRlc3Rz L2h0bWwvZG9tL2ludGVyZmFjZXMuaHRtbCBmb3IgaW9zLXNpbXVsYXRvciBhZnRlciByMTk2NjA3 CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9UZXN0RXhwZWN0YXRpb25zIGIvTGF5b3V0VGVzdHMv VGVzdEV4cGVjdGF0aW9ucwppbmRleCBjNTE4NDQ0YTI5NjNjZjBjNGU5ZDYwNjkyNzJmMjNmNjkw MGQxMDQzLi40NGFiMmNiMTM5NTQ4YTRiZWNlZWI2ZWMxOTQ1MzNlNTQ0MDNjMmE4IDEwMDY0NAot LS0gYS9MYXlvdXRUZXN0cy9UZXN0RXhwZWN0YXRpb25zCisrKyBiL0xheW91dFRlc3RzL1Rlc3RF eHBlY3RhdGlvbnMKQEAgLTgzMyw3ICs4MzMsNiBAQCB3ZWJraXQub3JnL2IvMTUzMTY2IGh0dHAv dGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3JlcG9ydC11cmktZnJvbS1qYQog d2Via2l0Lm9yZy9iLzE1MzE2NiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBv bGljeS9yZXBvcnQtdXJpLmh0bWwgWyBGYWlsdXJlIF0KIHdlYmtpdC5vcmcvYi8xNTMxNjYgd2Vi a2l0Lm9yZy9iLzE1MzI0MiBodHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGlj eS9yZXBvcnQtYW5kLWVuZm9yY2UuaHRtbCBbIEZhaWx1cmUgXQogd2Via2l0Lm9yZy9iLzE1MzE2 NiB3ZWJraXQub3JnL2IvMTUzMjQyIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5 UG9saWN5L3JlcG9ydC1ibG9ja2VkLWRhdGEtdXJpLmh0bWwgWyBGYWlsdXJlIF0KLXdlYmtpdC5v cmcvYi8xNTMxNjggaHR0cC90ZXN0cy9zZWN1cml0eS9jb250ZW50U2VjdXJpdHlQb2xpY3kvc291 cmNlLWxpc3QtcGFyc2luZy0wNy5odG1sIFsgRmFpbHVyZSBdCiB3ZWJraXQub3JnL2IvMTUzMTcw IGh0dHAvdGVzdHMvc2VjdXJpdHkvY29udGVudFNlY3VyaXR5UG9saWN5L3NvdXJjZS1saXN0LXBh cnNpbmctcGF0aHMtMDMuaHRtbCBbIEZhaWx1cmUgXQogaHR0cC90ZXN0cy9zZWN1cml0eS9jb250 ZW50U2VjdXJpdHlQb2xpY3kvc2NyaXB0LXNyYy1ibG9ja2VkLWVycm9yLWV2ZW50Lmh0bWwgWyBQ YXNzIEZhaWx1cmUgXQogCg==