1023991 - Content Security Policy (CSP) Incorrectly Matching Scheme with Wildcards

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect)

Description

[virgofx]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

Send a CSP header as follows in a test page that loads an image from an external site that is using HTTPS with a wildcard. Firefox does not match both HTTP and HTTPS as it should.  The following excerpt loads an image from HTTPS of imgur.

#test.php

<?php
header("Content-Security-Policy: img-src 'self' *.imgur.com");
?>
<img src="https://i.imgur.com/3Zq0xu0.png" />



Actual results:

The console reports the following CSP error:

Content Security Policy: The page's settings blocked the loading of a resource at https://i.imgur.com/3Zq0xu0.png ("img-src http://*mydomain*:80 http://*.imgur.com:80").


Expected results:

No content security policy warnings should appear.

The wildcard in the CSP should not have to explicitly denote (https://*.imgur.com). Setting it with the scheme does explicitly work; however, this would require multiple entries for both http/https denoted resources which is incorrect per the schema definition.

Comment 1

[Peter Sztan]

this bug is still present in current stable builds (35.0.1), I would also consider this a higher priority than normal, but thats probably just me

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Matt, Kamil, can someone check if that is still an issue?

Comment 3

[Kamil Jozwiak [:kjozwiak]]

Attachment: testcase.zip

Reproduced the original issue using the following build:
* https://archive.mozilla.org/pub/firefox/releases/35.0.1/mac/en-US/

Using imgSrc: ['self', '*.imgur.com'] via the test case attached, received the following error in the browser console:

Content Security Policy: The page's settings blocked the loading of a resource at https://i.imgur.com/3Zq0xu0.png ("img-src http://kjozwiak.local:22935 http://*.imgur.com").

Went through verification using the following builds:
* https://archive.mozilla.org/pub/firefox/nightly/2016/03/2016-03-10-03-02-42-mozilla-central/
* https://archive.mozilla.org/pub/firefox/nightly/2016/03/2016-03-10-00-40-11-mozilla-aurora/
* https://archive.mozilla.org/pub/firefox/candidates/46.0b1-candidates/build8/mac/en-US/
* https://archive.mozilla.org/pub/firefox/releases/45.0/mac/en-US/

Results:

* fx48.0a1 - PASSED
** image loaded without issues, no CSP messages under the browser console

* fx47.0a2 - PASSED
** image loaded without issues, no CSP messages under the browser console

* fx46.0b1 - PASSED
** image loaded without issues, no CSP messages under the browser console

* fx45.0 - PASSED
** image loaded without issues, no CSP messages under the browser console

Chris, this doesn't seem to be an issue anymore.. I reproduced the problem with fx35.0.1 but couldn't reproduce it with fx48.0a1, fx47.0a2, fx46.0b1, fx45.0.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Kamil Jozwiak [:kjozwiak] from comment #3)
> Chris, this doesn't seem to be an issue anymore.. I reproduced the problem
> with fx35.0.1 but couldn't reproduce it with fx48.0a1, fx47.0a2, fx46.0b1,
> fx45.0.

Thanks Kamil, that's what I thought. We refactored permitsScheme() within Bug 1139297 which should now allow https schemes in an http context. Great!