Bug 267579
| Summary: | Enforce requirement that keyword sources in CSP source expressions must be separated by whitespace | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Luke Warlow <lwarlow> |
| Component: | New Bugs | Assignee: | sideshowbarker <mike> |
| Status: | NEW | ||
| Severity: | Normal | CC: | karlcow, mike, rreno, webkit-bug-importer |
| Priority: | P2 | Keywords: | BrowserCompat, InRadar |
| Version: | Safari 17 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=289904 | ||
Luke Warlow
Load `data:text/html,<meta http-equiv="Content-Security-Policy" content="script-src 'self''foo';">` in Chromium and you will correctly see a warning in the console.
Load the same URL in Safari and you won't see any errors.
Safari appears to only be matching that the buffer contains 'self' and not checking that the immediate next character is whitespace.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/121196747>
sideshowbarker
Pull request: https://github.com/WebKit/WebKit/pull/24217