Accept invalid chrome-extension:// and chrome:// CSP tokens

extensions/common/csp_validator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 
 #include <vector>
 
 #include "base/strings/string_split.h"
 #include "base/strings/string_tokenizer.h"
@@ skipping 36 matching lines @@
                       bool should_check_rcd) {
   if (!StartsWithASCII(url, scheme_and_separator, true))
     return false;
 
   size_t start_of_host = scheme_and_separator.length();
 
   size_t end_of_host = url.find("/", start_of_host);
   if (end_of_host == std::string::npos)
     end_of_host = url.size();
 
+  // A missing host such as "chrome-extension://" is invalid, but for backwards-
+  // compatibility, accept such CSP parts. They will be ignored by Blink anyway.
+  // TODO(robwu): Remove this special case once crbug.com/434773 is fixed.
+  if (start_of_host == end_of_host)
+    return true;
+
   // Note: It is sufficient to only compare the first character against '*'
   // because the CSP only allows wildcards at the start of a directive, see
   // host-source and host-part at http://www.w3.org/TR/CSP2/#source-list-syntax
   bool is_wildcard_subdomain = end_of_host > start_of_host + 2 &&
       url[start_of_host] == '*' && url[start_of_host + 1] == '.';
   if (is_wildcard_subdomain)
     start_of_host += 2;
 
   size_t start_of_port = url.rfind(":", end_of_host);
   // The ":" check at the end of the following condition is used to avoid
@@ skipping 175 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // namespace csp_validator
 
 }  // namespace extensions