extensions/common/csp_validator.cc - Issue 481643002: Disallow non-subdomain wildcards in the extension's CSP

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: extensions/common/csp_validator.cc

Issue 481643002: Disallow non-subdomain wildcards in the extension's CSP (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Created 6 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « chrome/common/extensions/docs/templates/articles/contentSecurityPolicy.html ('k') | extensions/common/csp_validator_unittest.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: extensions/common/csp_validator.cc

diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc

index d19c7f27ef803c519421858fa31f4171a208b5c4..d9788e7d41c5e7100b60cd085b6e592312ef867e 100644

--- a/extensions/common/csp_validator.cc

+++ b/extensions/common/csp_validator.cc

@@ -44,7 +44,7 @@ bool HasOnlySecureTokens(base::StringTokenizer& tokenizer,

std::string source = tokenizer.token();

base::StringToLowerASCII(&source);

- // Don't alow whitelisting of all hosts. This boils down to:

+ // Don't allow whitelisting of all hosts. This boils down to:

// 1. Maximum of 2 '*' characters.

// 2. Each '*' is either followed by a '.' or preceded by a ':'

int wildcards = 0;

@@ -71,7 +71,7 @@ bool HasOnlySecureTokens(base::StringTokenizer& tokenizer,

LowerCaseEqualsASCII(source, "http://localhost") ||

StartsWithASCII(source, "http://127.0.0.1:", false) ||

StartsWithASCII(source, "http://localhost:", false) ||

- StartsWithASCII(source, "https://", true) ||

+ (StartsWithASCII(source, "https://", true) && source.length() > 8) ||

not at google - send to devlin 2014/08/18 17:17:18 what is 8?

robwu 2014/08/18 19:50:05 The length of "https://".

not at google - send to devlin 2014/08/18 19:53:40 I think that (StartsWithASCII(source, "https://")

robwu 2014/08/18 21:08:18 Done. See the bug report and the other CL at the l

StartsWithASCII(source, "chrome://", true) ||

StartsWithASCII(source,

std::string(extensions::kExtensionScheme) +