Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(34)

Unified Diff: extensions/common/csp_validator.cc

Issue 722233004: Accept invalid chrome-extension:// and chrome:// CSP tokens (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Simplify patch - just accept any empty host Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: extensions/common/csp_validator.cc
diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc
index 65edd0a3aaffb578226972e59369a15c6b7fc8e0..622136757b255176a761f9a9275ec85cd86ba2b5 100644
--- a/extensions/common/csp_validator.cc
+++ b/extensions/common/csp_validator.cc
@@ -54,6 +54,11 @@ bool isNonWildcardTLD(const std::string& url,
if (end_of_host == std::string::npos)
end_of_host = url.size();
+ // A missing host such as "chrome-extension://" is invalid, but for backwards-
+ // compatibility, accept such CSP parts. They will be ignored by Blink anyway.
+ if (start_of_host == end_of_host)
+ return true;
+
// Note: It is sufficient to only compare the first character against '*'
// because the CSP only allows wildcards at the start of a directive, see
// host-source and host-part at http://www.w3.org/TR/CSP2/#source-list-syntax
« no previous file with comments | « no previous file | extensions/common/csp_validator_unittest.cc » ('j') | extensions/common/csp_validator_unittest.cc » ('J')

Powered by Google App Engine
This is Rietveld 408576698