diff options
| author | rob <rob@robwu.nl> | 2014-11-19 09:39:56 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2014-11-19 17:40:20 +0000 |
| commit | cbc409a84a88dd002c37f113eabb74468448d00d (patch) | |
| tree | 71efa809c6a7ca8e10ad964577c478f0ae8848af /extensions/common/csp_validator.cc | |
| parent | 14875e499f956ee6e761d3c896a7664af85801e8 (diff) | |
| download | chromium_src-cbc409a84a88dd002c37f113eabb74468448d00d.zip chromium_src-cbc409a84a88dd002c37f113eabb74468448d00d.tar.gz chromium_src-cbc409a84a88dd002c37f113eabb74468448d00d.tar.bz2 | |
Revert of Accept invalid chrome-extension:// and chrome:// CSP tokens (patchset #3 id:80001 of https://codereview.chromium.org/722233004/)
Reason for revert:
Need some extra comments before relanding
Original issue's description:
> Accept invalid chrome-extension:// and chrome:// CSP tokens
>
> Do not refuse to load the extension when the CSP contains
> "chrome-extension://", because there are some extensions in the wild
> that contains this token in the CSP. It is safe to accept this token
> because the invalid CSP token is ignored by Blink (together with an
> error message in the console, so the developer can fix the problem if
> they bother to look at the console).
>
> BUG=432227
> TBR=kalman@chromium.org
>
> Committed: https://crrev.com/67244e678279741947c09ba2ab18fbfec1707a97
> Cr-Commit-Position: refs/heads/master@{#304799}
TBR=kalman@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=432227
Review URL: https://codereview.chromium.org/739133003
Cr-Commit-Position: refs/heads/master@{#304832}
Diffstat (limited to 'extensions/common/csp_validator.cc')
| -rw-r--r-- | extensions/common/csp_validator.cc | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/extensions/common/csp_validator.cc b/extensions/common/csp_validator.cc index 6221367..65edd0a 100644 --- a/extensions/common/csp_validator.cc +++ b/extensions/common/csp_validator.cc @@ -54,11 +54,6 @@ bool isNonWildcardTLD(const std::string& url, if (end_of_host == std::string::npos) end_of_host = url.size(); - // A missing host such as "chrome-extension://" is invalid, but for backwards- - // compatibility, accept such CSP parts. They will be ignored by Blink anyway. - if (start_of_host == end_of_host) - return true; - // Note: It is sufficient to only compare the first character against '*' // because the CSP only allows wildcards at the start of a directive, see // host-source and host-part at http://www.w3.org/TR/CSP2/#source-list-syntax |