New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 590505 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Buried. Ping if important.
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Security: Content Security Policy path bypass

Reported by shek...@gmail.com, Feb 28 2016

Issue description

Both Chromium and Firefox decided to do case-sensitive matching for `path-part` of `source-expression`, despite both CSP v2 and v3 are telling to do case-insensitive match (I reported it in https://bugs.chromium.org/p/chromium/issues/detail?id=590502).

Given a header of `Content-Security-Policy: script-src localhost/a/B/c/d/`, the script `<script src="//localhost/a/b/c/d/script.js"></script>` should not be loaded, as specification doesn't provide special handling for non-first entry in `source-expression-path-list`. 
VULNERABILITY DETAILS

Example code that does not load the script in FF and loads in Chromium:
```
package main

import (
    "fmt"
    "net/http"
)
func main() {
    http.HandleFunc("/script/a/b/c/d/script.js", func(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintln(w, `
    alert(1);
  `)
    })

    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("Content-Security-Policy", "script-src localhost:8888/script/a/b/C/D/")
    fmt.Fprintln(w, `<html>
    <body>
      <script src='/script/a/b/c/d/script.js'></script>
    </body>
  </html>`)
    })
    http.ListenAndServe(":8888", nil)
}

```

VERSION
Chrome Version: 50.0.2652.0 dev (64-bit)
Operating System: Darwin 15.3.0 Darwin Kernel Version 15.3.0; root:xnu-3248.30.4~1/RELEASE_X86_64 x86_64

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace, registers, exception record]
Client ID (if relevant): [see link above]

 

Comment 1 by och...@chromium.org, Feb 29 2016

Components: Blink>SecurityFeature
Labels: Type-Bug
Owner: mkwst@chromium.org
Status: Assigned (was: Unconfirmed)
mkwst, can you take a look at this?

Comment 2 by shek...@gmail.com, Mar 1 2016

Just to summarize, and since https://bugs.chromium.org/p/chromium/issues/detail?id=590502 is resolved: non-first `source-expression-path-list` entries are matched case-insensitively. 
Project Member

Comment 3 by bugdroid1@chromium.org, Apr 8 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb

commit 7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb
Author: shekyan <shekyan@gmail.com>
Date: Fri Apr 08 10:02:06 2016

Match `path-part` with `url` case-sensitively

This fixes a bug where if final character of `path-part`
in `source-expression` is the U+002F SOLIDUS character (/),
matching with path of the `url` was performed case-insensitively.
Less strict matching can lead to CSP bypass in certain
circumstances or, at least, user confusion.

This fixes the bug by ensuring that `path-part` matching is
performed case-sensitively, per
https://w3c.github.io/webappsec-csp/#match-url-to-source-expression

BUG= 590505 
R=mkwst@chromium.org

Review URL: https://codereview.chromium.org/1872563004

Cr-Commit-Position: refs/heads/master@{#386032}

[modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/AUTHORS
[modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
[modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp
[modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

Comment 4 by mkwst@chromium.org, May 2 2016

Cc: dba...@webkit.org ddkil...@apple.com

Comment 5 by shek...@gmail.com, Jul 12 2016

Why does it have restricted view? Is it subject to bug bounty program award?

Comment 6 by mkwst@chromium.org, Jul 12 2016

Labels: Security_Severity-Low Security_Impact-Stable Pri-3
You filed it as a security bug, so it's restricted by default until the patch hits stable. I've added flags to this that should put it into the review queue, but I don't think it's high-enough severity to qualify for a bounty. Happily, however, I'm not responsible for making that determination. :)

Comment 7 by mea...@chromium.org, Apr 21 2017

mkwst: It seems like this is fixed by #3 and can be closed. Can you please confirm?

Comment 8 by mkwst@chromium.org, Sep 19 2017

Status: Fixed (was: Assigned)
Fixed in 2016; should have closed it out then. My bad!
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 19 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 10 by sheriffbot@chromium.org, Dec 26 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment