Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

unsafe use of firstPartyUrl #4137

Closed
diracdeltas opened this issue Sep 20, 2016 · 0 comments · Fixed by #4145
Closed

unsafe use of firstPartyUrl #4137

diracdeltas opened this issue Sep 20, 2016 · 0 comments · Fixed by #4145
Assignees
@diracdeltas
Labels
QA/no-qa-needed security
Milestone
0.12.3dev

Comments

@diracdeltas
Copy link
Member

we are using it for main frame URL checking in a few places, which is not exactly safe according to https://cs.chromium.org/chromium/src/net/url_request/url_request.h?sq=package:chromium&dr=C&l=257
@diracdeltas diracdeltas added this to the 0.12.3dev milestone Sep 20, 2016
@diracdeltas diracdeltas self-assigned this Sep 20, 2016
diracdeltas added a commit that referenced this issue Sep 21, 2016
@diracdeltas
use main frame url for webrequest first party url
c3cf2e4 
fix #4137

auditors: @bridiver
@diracdeltas diracdeltas mentioned this issue Sep 21, 2016
Merged
4 tasks
@bbondy bbondy modified the milestones: 0.12.2dev, 0.12.3dev Sep 21, 2016
diracdeltas added a commit that referenced this issue Sep 26, 2016
@diracdeltas
use main frame url for webrequest first party url
0384ab3 
adds a test which fails on master (shows 0 blocked elements instead of 23)

fix #4137

auditors: @bridiver
This was referenced Sep 27, 2016
Closed
Closed
Closed
Closed
@srirambv srirambv mentioned this issue Sep 28, 2016
Closed
This was referenced Sep 29, 2016
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@diracdeltas diracdeltas

Labels
QA/no-qa-needed security
Projects
None yet
Milestone
0.12.3dev
Development

Successfully merging a pull request may close this issue.

use main frame url for webrequest first party url brave/browser-laptop
6 participants
@aekeus @diracdeltas @bbondy @alexwykoff @luixxiul @srirambv