558429 - CSP policy-uri should accept relative URIs

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[Sid Stamm [:geekboy or :sstamm]]

We should allow the use of relative URIs in policy-uri, since there are so many restrictions on it anyway, policies could be shortened by just specifying a path.  For example, on a page at https://mysite.com/foo:

X-Content-Security-Policy: policy-uri /lockdown.csp

Would cause the policy to be loaded from https://mysite.com/lockdown.csp

Comment 1

[Sid Stamm [:geekboy or :sstamm]]

Attachment: Proposed Patch

Lifted URI-ification of selfUri out of the specific policy-uri parsing bit of the loop, and set selfUri as the base URI when parsing the policy uri.

Comment 2

[Brandon Sterne (:bsterne)]

Comment on attachment 450247 [details] [diff] [review]
Proposed Patch

r=bsterne

Comment 3

[Benjamin Smedberg]

Comment on attachment 450247 [details] [diff] [review]
Proposed Patch

Please do not request approval until reviews are complete.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 450247 [details] [diff] [review]
Proposed Patch

r=dveditz

Comment 5

[Brandon Sterne (:bsterne)]

http://hg.mozilla.org/mozilla-central/rev/930f0a4d70d0