CSP: Source expressions can no longer lock sites into insecurity.

CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

On the dashboard at https://www.chromestatus.com/feature/6653486812889088.

[1]: https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b9697ff7b60
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765, 558232
Committed: https://crrev.com/568075bbc5d16239a5cbdeb579a8768f9836f13e
Cr-Commit-Position: refs/heads/master@{#360562}

[Mike West, 2015-11-19 08:51:04]

Description was changed from

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7
==========

to

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765
==========

[Mike West, 2015-11-19 08:51:04]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org, philipj@opera.com

[Mike West, 2015-11-19 08:52:05]

Hi Jochen, Philip!

This is a fairly tiny change that brings our CSP implementation into line with
the (CSP3) spec and with Firefox. I'm happy to throw an intent at the list if
you think it's worth doing.

-mike

[jochen (gone - plz use gerrit), 2015-11-19 08:56:07]

lgtm

[Mike West, 2015-11-19 08:56:27]

Description was changed from

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765
==========

to

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

On the dashboard at https://www.chromestatus.com/feature/6653486812889088.

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765
==========

[Mike West, 2015-11-19 08:57:26]

Description was changed from

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

On the dashboard at https://www.chromestatus.com/feature/6653486812889088.

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765
==========

to

==========
CSP: Source expressions can no longer lock sites into insecurity.

CSP's matching algorithm has been updated to make clever folks like Yan
slightly less able to gather data on user's behavior based on CSP
reports[1]. This matches Firefox's existing behavior (they apparently
changed this behavior a few months ago, via a happy accident[2]), and
mitigates the CSP-variant of Sniffly[3].

On the dashboard at https://www.chromestatus.com/feature/6653486812889088.

[1]:
https://github.com/w3c/webappsec-csp/commit/0e81d81b64c42ca3c81c048161162b969...
[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218524#c2
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1218778#c7

BUG=544765,558232
==========

[philipj_slow, 2015-11-19 09:02:45]

lgtm too

Didn't know about Sniffly before, that was awesome! (in a bad way)

[Mike West, 2015-11-19 10:14:01]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2015-11-19 10:14:35]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1455973003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1455973003/1

[commit-bot: I haz the power, 2015-11-19 11:54:34]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-11-19 11:55:20]

Patchset 1 (id:??) landed as
https://crrev.com/568075bbc5d16239a5cbdeb579a8768f9836f13e
Cr-Commit-Position: refs/heads/master@{#360562}