diff options
| author | jww <jww@chromium.org> | 2015-09-25 16:45:36 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-09-25 23:46:26 +0000 |
| commit | 5d0e9f824e05523e03dabc0e341b9f8f17a72bb0 (patch) | |
| tree | 268f95b6f317f46986bf78a606546a5d424eb9da /extensions/common/manifest_handlers | |
| parent | 4b86b23ef2edc67efd12a111ad4ddf83ca53329c (diff) | |
| download | chromium_src-5d0e9f824e05523e03dabc0e341b9f8f17a72bb0.zip chromium_src-5d0e9f824e05523e03dabc0e341b9f8f17a72bb0.tar.gz chromium_src-5d0e9f824e05523e03dabc0e341b9f8f17a72bb0.tar.bz2 | |
Disallow CSP source * matching of data:, blob:, and filesystem: URLs
The CSP spec specifically excludes matching of data:, blob:, and
filesystem: URLs with the source '*' wildcard. This adds checks to make
sure that doesn't happen, along with tests.
BUG=534570
R=mkwst@chromium.org
Review URL: https://codereview.chromium.org/1361763005
Cr-Commit-Position: refs/heads/master@{#350950}
Diffstat (limited to 'extensions/common/manifest_handlers')
| -rw-r--r-- | extensions/common/manifest_handlers/csp_info.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/common/manifest_handlers/csp_info.cc b/extensions/common/manifest_handlers/csp_info.cc index 5581d51..de98430 100644 --- a/extensions/common/manifest_handlers/csp_info.cc +++ b/extensions/common/manifest_handlers/csp_info.cc @@ -34,7 +34,7 @@ const char kDefaultPlatformAppContentSecurityPolicy[] = // Platform apps can only use local resources by default. "default-src 'self' blob: filesystem: chrome-extension-resource:;" // For remote resources, they can fetch them via XMLHttpRequest. - " connect-src *;" + " connect-src * data: blob: filesystem:;" // And serve them via data: or same-origin (blob:, filesystem:) URLs " style-src " PLATFORM_APP_LOCAL_CSP_SOURCES " 'unsafe-inline';" " img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";" @@ -45,7 +45,7 @@ const char kDefaultPlatformAppContentSecurityPolicy[] = // spotty connectivity. // 2. Fetching via XHR and serving via blob: URLs currently does not allow // streaming or partial buffering. - " media-src *;"; + " media-src * data: blob: filesystem:;"; int GetValidatorOptions(Extension* extension) { int options = csp_validator::OPTIONS_NONE; |