wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 06:48:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

CSP should only check host (not including path) when performing frame ancestors checks.

Browse source 
This has been explicitly stated in the CSP-3 spec.
This commit is contained in:
wolfbeast 2017-08-15 21:10:10 +02:00 • committed by Roy Tam
commit fd1bb58ea8
4 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
dom/security/nsCSPParser.cpp
View file

@ -136,6 +136,7 @@ nsCSPParser::nsCSPParser(cspTokens& aTokens,
, mUnsafeInlineKeywordSrc(nullptr)
, mChildSrc(nullptr)
, mFrameSrc(nullptr)
, mParsingFrameAncestorsDir(false)
, mTokens(aTokens)
, mSelfURI(aSelfURI)
, mPolicy(nullptr)
@ -807,6 +808,7 @@ nsCSPParser::sourceExpression()
if (nsCSPHostSrc *cspHost = hostSource()) {
// Do not forget to set the parsed scheme.
cspHost->setScheme(parsedScheme);
cspHost->setWithinFrameAncestorsDir(mParsingFrameAncestorsDir);
return cspHost;
}
// Error was reported in hostSource()
@ -1209,6 +1211,9 @@ nsCSPParser::directive()
mStrictDynamic = false;
mUnsafeInlineKeywordSrc = nullptr;
mParsingFrameAncestorsDir =
CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::FRAME_ANCESTORS_DIRECTIVE);
// Try to parse all the srcs by handing the array off to directiveValue
nsTArray<nsCSPBaseSrc*> srcs;
directiveValue(srcs);