Bug 153168

Summary:

CSP: Disallow an empty host in a host-source source expression

Product:

WebKit

Reporter:

Daniel Bates <dbates>

Component:

WebCore Misc.

Assignee:

Daniel Bates <dbates>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, commit-queue, mkwst, webkit-bug-importer

Priority:

Keywords:

BlinkMergeCandidate, InRadar

Version:

WebKit Local Build

Hardware:

All

OS:

All

Bug Depends on:

Bug Blocks:

153170

Attachments:

Description	Flags
Patch	bfulgham: review+

Description Daniel Bates 2016-01-15 18:10:04 PST

We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=180407>.

Disallow an empty host in a CSP host-source directive

Currently "https://" is accepted and treated like "https:". This behavior has never been part of any standard.

The syntax is specified in http://www.w3.org/TR/CSP11/#source-list-syntax

host-source       = [ scheme-part "://" ] host-part [ port-part ] [ path-part ]
host-part         = "*" / [ "*." ] 1*host-char *( "." 1*host-char )

As you can see, the host-part is NOT optional.

Comment 1 Radar WebKit Bug Importer 2016-01-27 20:59:42 PST

<rdar://problem/24383366>

Comment 2 Daniel Bates 2016-02-16 11:51:04 PST

Created attachment 271461 [details]
Patch

Comment 3 Brent Fulgham 2016-02-16 12:28:32 PST

Comment on attachment 271461 [details]
Patch

r=me.

Comment 4 Daniel Bates 2016-02-16 13:16:18 PST

Committed r196653: <http://trac.webkit.org/changeset/196653>