[CSP] test that quote characters other than U+0027 APOSTROPHE don't work #23561
Conversation
There was a problem hiding this comment.
@ArthurSonzogni to weigh in on whether we can reasonably change Chromium's behavior.
| var tests = [ | ||
| { "csp": "img-src 'none';", "expected": false, "name": "precondition: single quotes are accepted" }, | ||
| // See https://github.com/w3c/webappsec-csp/issues/434 for background on what is tested. | ||
| { "csp": 'img-src "none";', "expected": true, "name": "double quotes should not be accepted" }, |
There was a problem hiding this comment.
In Chromium, this treats the source "none" as an unknown source, leaving us with img-src, which is an empty list, which is the same as 'none'.
| { "csp": "img-src \u0091none'", "expected": true, "name": "U+0091 + single quote should not be accepted" }, | ||
| { "csp": "img-src 'none\u0092", "expected": true, "name": "single quote + U+0092 should not be accepted" }, | ||
| { "csp": "img-src \u0091none\u0092", "expected": true, "name": "U+0091 + U+0092 should not be accepted" }, | ||
| { "csp": "img-src \u2018none\u2019;", "expected": true, "name": "U+2018 + U+2019 should not be accepted" }, |
There was a problem hiding this comment.
In Chromium, these four all end up as parse failures for the directive, as it contains characters that can't exist in a directive. In this case, we punt the directive entirely. We should probably have the same behavior here that we have for "none" above: treat the policy as containing an img-src directive with no valid entries, which is equivalent to 'none'.
|
I checked the sources. Chrome consider all those "sources" to be invalid. They are ignored. As a result the source list is empty and behave as "img-src 'none'". I consider this behavior to be okay. I recognize that this is a bit confusing when the invalid source is "none". What would be the new behavior? To drop the directive entirely? (we currently only drop the invalid source) |
|
Abandoning before the 3 year anniversary of this PR, I'm realistically not going to come back to it. |
Part of w3c/webappsec-csp#434.