524066 - CSP should support dotless hosts

Status: RESOLVED FIXED

(Core :: Security, enhancement)

Description

[georgi - hopefully not receiving bugspam]

CSP doesn't seem to work correctly for dotless hosts - too restrictive.

policy allow: self with host say "desktop"

<script src="/script.js">
or
<script src="http://desktop/script.js">

block access to "desktop" though it is the original hosts.

dotless hosts may be legitimately used in intranets.

Comment 1

[Sid Stamm [:geekboy or :sstamm]]

The preview build correctly enforces policy as defined in the CSP specification... but we should probably change the specification to permit dotless hosts too since they seem useful.  I'll change the formal syntax and the parser implementation to accommodate this.

Syntax change:
 <host-name>         ::= "*" 
                       | <ldh-str>"."<ldh-str>
                       | <host-name>"."<ldh-str>
to:
 <host-name>         ::= "*" 
                       | <ldh-str>
                       | <host-name>"."<ldh-str>

Comment 2

[Sid Stamm [:geekboy or :sstamm]]

Attachment: proposed fix

This proposed fix removes the checks on parsed hosts that makes sure it is one of the following:
(1) equal to "*"
(2) equal to "localhost"
(3) more than one segment ("x.y", "*.y", etc...)

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 429267 [details] [diff] [review]
proposed fix

r=dveditz

Comment 4

[Brandon Sterne (:bsterne)]

http://hg.mozilla.org/mozilla-central/rev/426165b08c0c