Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix source list intersection algorithm #18

Merged
merged 1 commit into from
Sep 2, 2020
Merged

Fix source list intersection algorithm #18

merged 1 commit into from
Sep 2, 2020

Conversation

antosart
Copy link
Member

@antosart antosart commented Aug 12, 2020 •
edited
Loading

The previous version of the algorithm computed a wrong intersection
for the following example:

A =  http://*.org:*/index.html
B =  http://*.org  http://*.example.org:*/index.html

While the correct intersection clearly is

C =  http://*.org/index.html  http://*.example.org:*/index.html

the previous version of the algorithm disregarded the first match and
instead just returned

C' =  http://*.example.org:*/index.html

which is stricter than the real intersection and hence makes it easier
for the returned policy to be subsumed by the required one.

Fix source list intersection algorithm
3a76d76 
The previous version of the algorithm computed a wrong intersection
for the following example:

A =  http://*.org:*/index.html
B =  http://*.org  http://*.example.org:*/index.html .

While the correct intersection clearly is

C =  http://*.org/index.html  http://*.example.org:*/index.html ,

the previous version of the algorithm disregarded the first match and
instead just returned

C' =  http://*.example.org:*/index.html ,

which is stricter than the real intersection and hence makes it easier
for the returned policy to be subsumed by the required one.
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Sep 1, 2020
@antosart @chromium-wpt-export-bot
Fix CSP source list intersection for CSPEE in blink
9ed635a 
As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
@chromium-wpt-export-bot chromium-wpt-export-bot mentioned this pull request Sep 1, 2020
Merged
mikewest
mikewest approved these changes Sep 2, 2020
View reviewed changes
Copy link
Member

@mikewest mikewest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@mikewest mikewest merged commit 9d84f90 into w3c:master Sep 2, 2020
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Sep 2, 2020
@antosart @chromium-wpt-export-bot
Fix CSP source list intersection for CSPEE in blink
9b49574 
As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Sep 2, 2020
@antosart @chromium-wpt-export-bot
Fix CSP source list intersection for CSPEE in blink
953dd70 
As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}
pull bot pushed a commit to FreddyZeng/chromium that referenced this pull request Sep 2, 2020
@antosart
Fix CSP source list intersection for CSPEE in blink
0ac6556 
As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Sep 8, 2020
@antosart @moz-wptsync-bot
Bug 1662412 [wpt PR 25322] - Fix CSP source list intersection for CSP…
f1cb978 
…EE in blink, a=testonly

Automatic update from web-platform-tests
Fix CSP source list intersection for CSPEE in blink

As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}

--

wpt-commits: 953dd708a465fc3f89a6c74812cc18b62bbfc724
wpt-pr: 25322
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this pull request Sep 16, 2020
@marco-c
Bug 1662412 [wpt PR 25322] - Fix CSP source list intersection for CSP…
1af2fc6 
…EE in blink, a=testonly

Automatic update from web-platform-tests
Fix CSP source list intersection for CSPEE in blink

As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org>
Reviewed-by: Mike West <mkwstchromium.org>
Commit-Queue: Antonio Sartori <antoniosartorichromium.org>
Cr-Commit-Position: refs/heads/master{#803799}

--

wpt-commits: 953dd708a465fc3f89a6c74812cc18b62bbfc724
wpt-pr: 25322

UltraBlame original commit: 1bc560f22f1205745b327602101708d9882a7482
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this pull request Sep 16, 2020
@marco-c
Bug 1662412 [wpt PR 25322] - Fix CSP source list intersection for CSP…
4ba4f9f 
…EE in blink, a=testonly

Automatic update from web-platform-tests
Fix CSP source list intersection for CSPEE in blink

As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org>
Reviewed-by: Mike West <mkwstchromium.org>
Commit-Queue: Antonio Sartori <antoniosartorichromium.org>
Cr-Commit-Position: refs/heads/master{#803799}

--

wpt-commits: 953dd708a465fc3f89a6c74812cc18b62bbfc724
wpt-pr: 25322

UltraBlame original commit: 1bc560f22f1205745b327602101708d9882a7482
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this pull request Sep 16, 2020
@marco-c
Bug 1662412 [wpt PR 25322] - Fix CSP source list intersection for CSP…
f321f99 
…EE in blink, a=testonly

Automatic update from web-platform-tests
Fix CSP source list intersection for CSPEE in blink

As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org>
Reviewed-by: Mike West <mkwstchromium.org>
Commit-Queue: Antonio Sartori <antoniosartorichromium.org>
Cr-Commit-Position: refs/heads/master{#803799}

--

wpt-commits: 953dd708a465fc3f89a6c74812cc18b62bbfc724
wpt-pr: 25322

UltraBlame original commit: 1bc560f22f1205745b327602101708d9882a7482
ambroff pushed a commit to ambroff/gecko that referenced this pull request Nov 4, 2020
@antosart @moz-wptsync-bot
Bug 1662412 [wpt PR 25322] - Fix CSP source list intersection for CSP…
1cffbe4 
…EE in blink, a=testonly

Automatic update from web-platform-tests
Fix CSP source list intersection for CSPEE in blink

As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}

--

wpt-commits: 953dd708a465fc3f89a6c74812cc18b62bbfc724
wpt-pr: 25322
mjfroman pushed a commit to mjfroman/moz-libwebrtc-third-party that referenced this pull request Oct 14, 2022
@antosart
Fix CSP source list intersection for CSPEE in blink
9b91c50 
As explained in w3c/webappsec-cspee#18,
Content-Security-Policy: Embedded Enforcement source list intersection
algorithm sometimes computes a wrong intersection of two lists of
source expressions.

Additionally, blink CSPEE source intersection algorithm was computing
a wrong intersection for http://*.com and http://*.example.com.

We fix those problems and add a unit test and WP tests.

Change-Id: Ie7b85d8c7e978af6b5e87141d257c66e5556be95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385458
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803799}
GitOrigin-RevId: 0ac6556f729e4c51e70f4a7091cbf2f662885638
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikewest mikewest mikewest approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@antosart @mikewest