Security: Content Security Policy path bypass
Reported by
shek...@gmail.com,
Feb 28 2016
|
||||||
Issue descriptionBoth Chromium and Firefox decided to do case-sensitive matching for `path-part` of `source-expression`, despite both CSP v2 and v3 are telling to do case-insensitive match (I reported it in https://bugs.chromium.org/p/chromium/issues/detail?id=590502). Given a header of `Content-Security-Policy: script-src localhost/a/B/c/d/`, the script `<script src="//localhost/a/b/c/d/script.js"></script>` should not be loaded, as specification doesn't provide special handling for non-first entry in `source-expression-path-list`. VULNERABILITY DETAILS Example code that does not load the script in FF and loads in Chromium: ``` package main import ( "fmt" "net/http" ) func main() { http.HandleFunc("/script/a/b/c/d/script.js", func(w http.ResponseWriter, r *http.Request) { fmt.Fprintln(w, ` alert(1); `) }) http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Security-Policy", "script-src localhost:8888/script/a/b/C/D/") fmt.Fprintln(w, `<html> <body> <script src='/script/a/b/c/d/script.js'></script> </body> </html>`) }) http.ListenAndServe(":8888", nil) } ``` VERSION Chrome Version: 50.0.2652.0 dev (64-bit) Operating System: Darwin 15.3.0 Darwin Kernel Version 15.3.0; root:xnu-3248.30.4~1/RELEASE_X86_64 x86_64 REPRODUCTION CASE Please include a demonstration of the security bug, such as an attached HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE make the file as small as possible and remove any content not required to demonstrate the bug. FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [tab, browser, etc.] Crash State: [see link above: stack trace, registers, exception record] Client ID (if relevant): [see link above]
,
Mar 1 2016
Just to summarize, and since https://bugs.chromium.org/p/chromium/issues/detail?id=590502 is resolved: non-first `source-expression-path-list` entries are matched case-insensitively.
,
Apr 8 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb commit 7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb Author: shekyan <shekyan@gmail.com> Date: Fri Apr 08 10:02:06 2016 Match `path-part` with `url` case-sensitively This fixes a bug where if final character of `path-part` in `source-expression` is the U+002F SOLIDUS character (/), matching with path of the `url` was performed case-insensitively. Less strict matching can lead to CSP bypass in certain circumstances or, at least, user confusion. This fixes the bug by ensuring that `path-part` matching is performed case-sensitively, per https://w3c.github.io/webappsec-csp/#match-url-to-source-expression BUG= 590505 R=mkwst@chromium.org Review URL: https://codereview.chromium.org/1872563004 Cr-Commit-Position: refs/heads/master@{#386032} [modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/AUTHORS [modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp [modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp [modify] https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
,
May 2 2016
,
Jul 12 2016
Why does it have restricted view? Is it subject to bug bounty program award?
,
Jul 12 2016
You filed it as a security bug, so it's restricted by default until the patch hits stable. I've added flags to this that should put it into the review queue, but I don't think it's high-enough severity to qualify for a bounty. Happily, however, I'm not responsible for making that determination. :)
,
Apr 21 2017
mkwst: It seems like this is fixed by #3 and can be closed. Can you please confirm?
,
Sep 19 2017
Fixed in 2016; should have closed it out then. My bad!
,
Sep 19 2017
,
Dec 26 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by och...@chromium.org
, Feb 29 2016Labels: Type-Bug
Owner: mkwst@chromium.org
Status: Assigned (was: Unconfirmed)