Disallow non-subdomain wildcards in the extension's CSP

extensions/common/csp_validator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 
 #include <vector>
 
 #include "base/strings/string_split.h"
 #include "base/strings/string_tokenizer.h"
@@ skipping 26 matching lines @@
   bool seen_in_policy;
   bool is_secure;
 };
 
 bool HasOnlySecureTokens(base::StringTokenizer& tokenizer,
                          Manifest::Type type) {
   while (tokenizer.GetNext()) {
     std::string source = tokenizer.token();
     base::StringToLowerASCII(&source);
 
-    // Don't alow whitelisting of all hosts. This boils down to:
+    // Don't allow whitelisting of all hosts. This boils down to:
     //   1. Maximum of 2 '*' characters.
     //   2. Each '*' is either followed by a '.' or preceded by a ':'
     int wildcards = 0;
     size_t length = source.length();
     for (size_t i = 0; i < length; ++i) {
       if (source[i] == L'*') {
         wildcards++;
         if (wildcards > 2)
           return false;
 
         bool isWildcardPort = i > 0 && source[i - 1] == L':';
         bool isWildcardSubdomain = i + 1 < length && source[i + 1] == L'.';
         if (!isWildcardPort && !isWildcardSubdomain)
           return false;
       }
     }
 
     // We might need to relax this whitelist over time.
     if (source == "'self'" ||
         source == "'none'" ||
         source == "http://127.0.0.1" ||
         LowerCaseEqualsASCII(source, "blob:") ||
         LowerCaseEqualsASCII(source, "filesystem:") ||
         LowerCaseEqualsASCII(source, "http://localhost") ||
         StartsWithASCII(source, "http://127.0.0.1:", false) ||
         StartsWithASCII(source, "http://localhost:", false) ||
-        StartsWithASCII(source, "https://", true) ||
+        (StartsWithASCII(source, "https://", true) && source.length() > 8) ||

[not at google - send to devlin, 2014/08/18 17:17:18]

what is 8?

[robwu, 2014/08/18 19:50:05]

The length of "https://".

[not at google - send to devlin, 2014/08/18 19:53:40]

I think that (StartsWithASCII(source, "https://") && source != "https://") would
be clearer, and accompany with a comment.

[robwu, 2014/08/18 21:08:18]

Done. See the bug report and the other CL at the linked bug if you need some
more context to review the comment.

         StartsWithASCII(source, "chrome://", true) ||
         StartsWithASCII(source,
                         std::string(extensions::kExtensionScheme) +
                             url::kStandardSchemeSeparator,
                         true) ||
         StartsWithASCII(source, "chrome-extension-resource:", true)) {
       continue;
     }
 
     // crbug.com/146487
@@ skipping 113 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // namespace csp_validator
 
 }  // namespace extensions