[Webkit-unassigned] [Bug 153158] New: CSP: 'blob:' URLs should not match 'self' in CSP source expression lists.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Jan 15 15:10:01 PST 2016
https://bugs.webkit.org/show_bug.cgi?id=153158
Bug ID: 153158
Summary: CSP: 'blob:' URLs should not match 'self' in CSP
source expression lists.
Classification: Unclassified
Product: WebKit
Version: WebKit Local Build
Hardware: All
OS: All
Status: NEW
Keywords: BlinkMergeCandidate
Severity: Normal
Priority: P2
Component: WebCore Misc.
Assignee: webkit-unassigned at lists.webkit.org
Reporter: dbates at webkit.org
We should merge <https://src.chromium.org/viewvc/blink?view=rev&revision=197354>.
'blob:' URLs should not match 'self' in CSP source expression lists.
Chrome is currently treating `'self'` as including `blob:` URLs. That's
against the spec (and Firefox), which requires whitelisting `blob:`
explicitly:
https://w3c.github.io/webappsec/specs/content-security-policy/#source-list-guid-matching.
This patch fixes our implementation.
Mozilla discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=1150957
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160115/177b5d07/attachment.html>
More information about the webkit-unassigned
mailing list