1414209 - Content Security Policy confused by order of preload Link headers

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Sjon Hortensius]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0
Build ID: 20171027085204

Steps to reproduce:

When multiple Link headers (or possibly multiple values in a single header) are present - the CSP handler gets confused and incorrectly blocks the preload. This reproduces it in PHP:

header("Content-Security-Policy: script-src 'self' cdn.jsdelivr.net; style-src 'self';");
// this fails incorrectly
header("Link: </s/c.css>; rel=preload; as=style, </s/c.js>; rel=preload; as=script, <https://cdn.jsdelivr.net/gh/ajaxorg/ace-builds@1.2.8/src-min-noconflict/worker-php.js>; rel=preload; as=script");

// this has the same values in a different order - and works
// header("Link: </s/c.js>; rel=preload; as=script, </s/c.css>; rel=preload; as=style, <https://cdn.jsdelivr.net/gh/ajaxorg/ace-builds@1.2.8/src-min-noconflict/worker-php.js>; rel=preload; as=script");



Actual results:

Content Security Policy: The page’s settings blocked the loading of a resource at https://cdn.jsdelivr.net/gh/ajaxorg/ace-builds@1.2.8/src-min-noconflict/worker-php.js (“style-src http://site.com”).


Expected results:

no error

Comment 1

[Daniel Veditz [:dveditz]]

Dragana: This feels like it's broken in the link header processing of the "as=" bits -- is that something you're working on, or if not do you know who it would be?

Comment 2

[Dragana Damjanovic [:dragana]]

I can take a look. preload is currently disabled. but it would be good to fix this.

Comment 3

[Dragana Damjanovic [:dragana]]

Attachment: bug_1414209_v1.patch

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8933735 [details] [diff] [review]
bug_1414209_v1.patch

Some comment about why this is needed would have been nice, but I looked at the method and the loop there.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f28a10b116e0
Truncate as value after each link header. r=smaug

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/f28a10b116e0