wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

CSP should only check host (not including path) when performing frame ancestors checks.

Browse source 
This has been explicitly stated in the CSP-3 spec.
This commit is contained in:
wolfbeast 2017-08-15 21:10:10 +02:00 • committed by Roy Tam
commit fd1bb58ea8
4 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
dom/security/nsCSPUtils.cpp
View file

@ -503,6 +503,7 @@ nsCSPSchemeSrc::toString(nsAString& outStr) const
nsCSPHostSrc::nsCSPHostSrc(const nsAString& aHost)
: mHost(aHost)
, mWithinFrameAncstorsDir(false)
{
ToLowerCase(mHost);
}
@ -686,6 +687,11 @@ nsCSPHostSrc::permits(nsIURI* aUri, const nsAString& aNonce, bool aWasRedirected
rv = url->GetFilePath(uriPath);
NS_ENSURE_SUCCESS(rv, false);
if (mWithinFrameAncstorsDir) {
// no path matching for frame-ancestors to not leak any path information.
return true;
}
nsString decodedUriPath;
CSP_PercentDecodeStr(NS_ConvertUTF8toUTF16(uriPath), decodedUriPath);