diff options
| author | rob <rob@robwu.nl> | 2014-11-19 15:33:58 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2014-11-19 23:34:11 +0000 |
| commit | 087183913f74ebd1e18964fabd269dfebb4763f3 (patch) | |
| tree | 3a3fcb970de8892c6ded44f81b6f5ec63118ab21 /extensions/common/csp_validator.cc | |
| parent | 798ccc5bd26900673f92fc80a0e3a76be81646c7 (diff) | |
| download | chromium_src-087183913f74ebd1e18964fabd269dfebb4763f3.zip chromium_src-087183913f74ebd1e18964fabd269dfebb4763f3.tar.gz chromium_src-087183913f74ebd1e18964fabd269dfebb4763f3.tar.bz2 | |
Accept invalid chrome-extension:// and chrome:// CSP tokens
Do not refuse to load the extension when the CSP contains
"chrome-extension://", because there are some extensions in the wild
that contains this token in the CSP. It is safe to accept this token
because the invalid CSP token is ignored by Blink (together with an
error message in the console, so the developer can fix the problem if
they bother to look at the console).
BUG=432227
R=kalman@chromium.org
Review URL: https://codereview.chromium.org/722233004
Cr-Commit-Position: refs/heads/master@{#304922}
Diffstat (limited to 'extensions/common/csp_validator.cc')
| -rw-r--r-- | extensions/common/csp_validator.cc | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc index 65edd0a..23af91c 100644 --- a/extensions/common/csp_validator.cc +++ b/extensions/common/csp_validator.cc @@ -54,6 +54,12 @@ bool isNonWildcardTLD(const std::string& url, if (end_of_host == std::string::npos) end_of_host = url.size(); + // A missing host such as "chrome-extension://" is invalid, but for backwards- + // compatibility, accept such CSP parts. They will be ignored by Blink anyway. + // TODO(robwu): Remove this special case once crbug.com/434773 is fixed. + if (start_of_host == end_of_host) + return true; + // Note: It is sufficient to only compare the first character against '*' // because the CSP only allows wildcards at the start of a directive, see // host-source and host-part at http://www.w3.org/TR/CSP2/#source-list-syntax |