Bug 154177 - CSP: Allow schemeless source expressions to match an HTTP or HTTPS resource
Summary: CSP: Allow schemeless source expressions to match an HTTP or HTTPS resource
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: Daniel Bates
URL:
Keywords: InRadar, WebExposed
: 146723 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-02-12 11:26 PST by Daniel Bates
Modified: 2017-09-10 05:56 PDT (History)
9 users (show)

See Also:

Attachments
Patch and Layout Tests (4.90 KB, patch)
2016-02-12 11:47 PST, Daniel Bates 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2016-02-12 11:26:07 PST 
Following up from bug #112573 and bug #153748, we should remove the ENABLE(CSP_NEXT)-guard around the code in ContentSecurityPolicy::protocolMatchesSelf() so that we allow a schemeless source expression to match against a HTTP or HTTPS resource.

For example, assume the page http://www.example.com has Content Security Policy script-src example.com. If the page loads an external JavaScript script https://example.com/script.js then the load will be blocked by the Content Security Policy of the page because the scheme of the page (http) differs from the scheme of the requested script (https). But the load should be allowed by <https://www.w3.org/TR/CSP2/#match-source-expression> (21 July 2015).
Comment 1 Daniel Bates 2016-02-12 11:26:39 PST 
<rdar://problem/22708772>
Comment 2 Daniel Bates 2016-02-12 11:47:12 PST 
Created attachment 271196 [details]
Patch and Layout Tests
Comment 3 Brent Fulgham 2016-02-15 09:54:05 PST 
Comment on attachment 271196 [details]
Patch and Layout Tests

r=me.
Comment 4 Daniel Bates 2016-02-15 10:53:56 PST 
Comment on attachment 271196 [details]
Patch and Layout Tests

Clearing flags on attachment: 271196

Committed r196581: <http://trac.webkit.org/changeset/196581>
Comment 5 Daniel Bates 2016-02-15 10:53:59 PST 
All reviewed patches have been landed.  Closing bug.
Comment 6 Daniel Bates 2016-02-15 20:28:29 PST 
*** Bug 146723 has been marked as a duplicate of this bug. ***
Comment 7 Czirkos Zoltan 2017-09-10 05:56:47 PDT 
Is this patch supposed to be in iOS 9.3.5?
The bug still exists on an iPhone 4 which is claiming to be up to date, although the date of closing the bug is February 2016.