CSP - source-expression allow upgrade from http to https-so but not from https to https-so |
|||||
Issue description
When a CSP source-expression is "http:" then the set of allowed schemes is {"http", "https", "http-so", "https-so"}
When a CSP source-expression is "https:" then the set of allowed schemes is { "https" }
It means that "https-so" is not allowed when the "https" scheme is whitelisted.
A test is documenting this behavior here:
https://codereview.chromium.org/2694233002/
We don't know if we ever see a suborigin serialization when we're hitting CSP.
Since the CSP will be checked also on the browser-side, we will need to check that this doesn't cause problems here neither.
,
Feb 21 2017
Hi, Andy.
,
Feb 23 2017
,
Feb 24 2017
,
Mar 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594 commit d25a9b7ba1e9858fe4d444267524f8ebe8ad8594 Author: andypaicu <andypaicu@chromium.org> Date: Mon Mar 13 14:37:10 2017 Stop CSP from matching independent scheme/port upgrades Content-Security-Policy allows an url to match a source-expression even if the scheme or the port doesn't matches, but in this case it must be an upgrade to a more secure scheme(http->https) and more secure port(80->443). The problem is that it happens independently, so it is allowed to have an upgrade of the port without the scheme (http over 443) or an upgrade of the scheme without the port (https over 80). This is a change to force the upgrade to be both over port and scheme. BUG= 692499 , 692442 Review-Url: https://codereview.chromium.org/2708873002 Cr-Commit-Position: refs/heads/master@{#456376} [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-10.html [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/CSPSource.h [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h [modify] https://crrev.com/d25a9b7ba1e9858fe4d444267524f8ebe8ad8594/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
,
Apr 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/76108c2bf3ad1a4bac901ad99230f58faf87bc4b commit 76108c2bf3ad1a4bac901ad99230f58faf87bc4b Author: andypaicu <andypaicu@chromium.org> Date: Tue Apr 11 08:03:58 2017 Stop CSP from matching independent scheme/port upgrades (content layer) Made the changes necessary in content to mimic the behaviour of https://codereview.chromium.org/2708873002 Copied from there: "Content-Security-Policy allows an url to match a source-expression even if the scheme or the port doesn't matches, but in this case it must be an upgrade to a more secure scheme(http->https) and more secure port(80->443). The problem is that it happens independently, so it is allowed to have an upgrade of the port without the scheme (http over 443) or an upgrade of the scheme without the port (https over 80). This is a change to force the upgrade to be both over port and scheme." BUG= 692499 , 692442 Review-Url: https://codereview.chromium.org/2792013002 Cr-Commit-Position: refs/heads/master@{#463570} [modify] https://crrev.com/76108c2bf3ad1a4bac901ad99230f58faf87bc4b/content/common/content_security_policy/csp_context.cc [modify] https://crrev.com/76108c2bf3ad1a4bac901ad99230f58faf87bc4b/content/common/content_security_policy/csp_context.h [modify] https://crrev.com/76108c2bf3ad1a4bac901ad99230f58faf87bc4b/content/common/content_security_policy/csp_source.cc [modify] https://crrev.com/76108c2bf3ad1a4bac901ad99230f58faf87bc4b/content/common/content_security_policy/csp_source_list.cc [modify] https://crrev.com/76108c2bf3ad1a4bac901ad99230f58faf87bc4b/content/common/content_security_policy/csp_source_unittest.cc
,
Apr 11 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by arthurso...@chromium.org
, Feb 15 2017Status: Untriaged (was: Available)