New issue
Advanced search Search tips

Issue 880362 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Check if CSP upgrade-insecure-requests works well on hash collision

Project Member Reported by tzik@chromium.org, Sep 4

Issue description

Just a memo of a work item.
When FrameLoader::UpgradeInsecureRequest() checks if it should upgrade the request, it matches the hash of host instead of the host itself.
This may cause unintended http to https upgrade on the hash collision.

Check if it may happen and if it matters.
 
Status: Available (was: Untriaged)

Sign in to add a comment