From 5233fe8e75fd5b155135c6eca35fb48e685c14e5 Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 12 Aug 2015 08:22:33 +0200 Subject: [PATCH] CSP2: Note the issue the 'CSP' header was meant to solve. --- specs/CSP2/index.html | 20 +++++++++++++++++--- specs/CSP2/index.src.html | 14 +++++++++++++- specs/CSP2/published/2015-08-PR.html | 18 ++++++++++++++++-- 3 files changed, 46 insertions(+), 6 deletions(-) diff --git a/specs/CSP2/index.html b/specs/CSP2/index.html index 80d8295c..ebfdecdc 100644 --- a/specs/CSP2/index.html +++ b/specs/CSP2/index.html @@ -111,7 +111,7 @@

Content Security Policy Level 2

Editor’s Draft, -

+
@@ -346,7 +346,7 @@

9 Security Considerations
  • 10 Implementation Considerations
      @@ -4963,7 +4963,7 @@

      -

      9.2. Violation Reports

      +

      9.2. Redirect Information Leakage

      @@ -4980,6 +4980,20 @@

      + + +

      The mitigations are not complete, however: redirects which are blocked will + produce side-effects which may be visible to JavaScript (via + img.naturalHeight, for instance). An earlier version of this + specification defined a + CSP + request header which servers could use (in conjunction with the + referer and origin headers) to determine whether + or not it was completely safe to redirect a user. This header caused some + issues with CORS processing (tracked in + whatwg/fetch#52), + and has been punted to the next version of this document.

      + diff --git a/specs/CSP2/index.src.html b/specs/CSP2/index.src.html index 3f6f903c..7388ad7c 100644 --- a/specs/CSP2/index.src.html +++ b/specs/CSP2/index.src.html @@ -3403,7 +3403,7 @@

      Cascading Style Sheet (CSS) Parsing

      -

      Violation Reports

      +

      Redirect Information Leakage

      The violation reporting mechanism in this document has been designed to mitigate the risk that a malicious web site could use @@ -3417,6 +3417,18 @@

      Violation Reports

      report might contain sensitive information contained in the redirected URL, such as session identifiers or purported identities. For this reason, the user agent includes only the origin of the blocked URL. + + The mitigations are not complete, however: redirects which are blocked will + produce side-effects which may be visible to JavaScript (via + img.naturalHeight, for instance). An earlier version of this + specification defined a + CSP + request header which servers could use (in conjunction with the + referer and origin headers) to determine whether + or not it was completely safe to redirect a user. This header caused some + issues with CORS processing (tracked in + whatwg/fetch#52), + and has been punted to the next version of this document.
      diff --git a/specs/CSP2/published/2015-08-PR.html b/specs/CSP2/published/2015-08-PR.html index f266c463..ed3ec8e9 100644 --- a/specs/CSP2/published/2015-08-PR.html +++ b/specs/CSP2/published/2015-08-PR.html @@ -307,7 +307,7 @@

      9 Security Considerations
    • 10 Implementation Considerations
        @@ -4924,7 +4924,7 @@

        -

        9.2. Violation Reports

        +

        9.2. Redirect Information Leakage

        @@ -4941,6 +4941,20 @@

        + + +

        The mitigations are not complete, however: redirects which are blocked will + produce side-effects which may be visible to JavaScript (via + img.naturalHeight, for instance). An earlier version of this + specification defined a + CSP + request header which servers could use (in conjunction with the + referer and origin headers) to determine whether + or not it was completely safe to redirect a user. This header caused some + issues with CORS processing (tracked in + whatwg/fetch#52), + and has been punted to the next version of this document.

        +