From 462aac7d987a182f22f92378c1c876400604dc80 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 24 Jan 2024 18:10:20 +0100 Subject: [PATCH] [HSTS] Let parent hosts determine whether HSTS subs should be applied. This aligns with the wording in RFC 6797. --- security/manager/ssl/nsSiteSecurityService.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/security/manager/ssl/nsSiteSecurityService.cpp b/security/manager/ssl/nsSiteSecurityService.cpp index 5a6ff3d46c..797d7e1479 100644 --- a/security/manager/ssl/nsSiteSecurityService.cpp +++ b/security/manager/ssl/nsSiteSecurityService.cpp @@ -658,8 +658,11 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost, *aCached = true; } if (siteState.mHSTSState == SecurityPropertySet) { - *aResult = siteState.mHSTSIncludeSubdomains; - break; + // We do not break here, and continue to walk up the domain in case + // any parent domain has HSTS set with included subdomains in which + // case it will take precedence. See RFC 6797. + // We latch the result with an or-assignment. + *aResult |= siteState.mHSTSIncludeSubdomains; } else if (siteState.mHSTSState == SecurityPropertyNegative) { *aResult = false; break; @@ -675,7 +678,6 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost, SSSLOG(("no HSTS data for %s found, walking up domain", subdomain)); } - // Use whatever we ended up with, which defaults to false. return NS_OK; }