wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-04 22:37:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

[HSTS] Let parent hosts determine whether HSTS subs should be applied.

Browse source 
This aligns with the wording in RFC 6797.
This commit is contained in:
Moonchild 2024-01-24 18:10:20 +01:00 • committed by roytam1
commit 462aac7d98
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
security/manager/ssl/nsSiteSecurityService.cpp
View file

@ -658,8 +658,11 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
*aCached = true; *aCached = true;
} }
if (siteState.mHSTSState == SecurityPropertySet) { if (siteState.mHSTSState == SecurityPropertySet) {
*aResult = siteState.mHSTSIncludeSubdomains; // We do not break here, and continue to walk up the domain in case
break; // any parent domain has HSTS set with included subdomains in which
// case it will take precedence. See RFC 6797.
// We latch the result with an or-assignment.
*aResult |= siteState.mHSTSIncludeSubdomains;
} else if (siteState.mHSTSState == SecurityPropertyNegative) { } else if (siteState.mHSTSState == SecurityPropertyNegative) {
*aResult = false; *aResult = false;
break; break;
@ -675,7 +678,6 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
SSSLOG(("no HSTS data for %s found, walking up domain", subdomain)); SSSLOG(("no HSTS data for %s found, walking up domain", subdomain));
} }
// Use whatever we ended up with, which defaults to false.
return NS_OK; return NS_OK;
} }