Title: [200852] releases/WebKitGTK/webkit-2.12
- Revision
- 200852
- Author
- [email protected]
- Date
- 2016-05-13 06:29:42 -0700 (Fri, 13 May 2016)
Log Message
Merge r200445 - CSP: Perform case sensitive match against path portion of source _expression_ URL that ends in '/'
https://bugs.webkit.org/show_bug.cgi?id=157275
Reviewed by Darin Adler.
Source/WebCore:
Merged from Blink:
<https://chromium.googlesource.com/chromium/src/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb>
Perform a case-sensitive prefix match of the path portion a source _expression_ that ends in '/'
against the path portion of a request URL as per step 8.5.4 of section Does url match _expression_
in origin with redirect count of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp>
(Editor's Draft, 27 April 2016).
* page/csp/ContentSecurityPolicySource.cpp:
(WebCore::ContentSecurityPolicySource::pathMatches):
LayoutTests:
Add test to ensure that the path portion of a request URL is case-sensitively
matched against the path portion of a source _expression_ that ends in '/'.
* http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01-expected.txt:
* http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html:
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (200851 => 200852)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-05-13 13:26:37 UTC (rev 200851)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-05-13 13:29:42 UTC (rev 200852)
@@ -1,3 +1,16 @@
+2016-05-04 Daniel Bates <[email protected]>
+
+ CSP: Perform case sensitive match against path portion of source _expression_ URL that ends in '/'
+ https://bugs.webkit.org/show_bug.cgi?id=157275
+
+ Reviewed by Darin Adler.
+
+ Add test to ensure that the path portion of a request URL is case-sensitively
+ matched against the path portion of a source _expression_ that ends in '/'.
+
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01-expected.txt:
+ * http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html:
+
2016-05-04 Youenn Fablet <[email protected]>
Clicks inside button elements are sometimes discarded when the mouse moves
Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html (200851 => 200852)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html 2016-05-13 13:26:37 UTC (rev 200851)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html 2016-05-13 13:29:42 UTC (rev 200852)
@@ -10,6 +10,7 @@
['no', 'script-src 127.0.0.1:*/sec/', 'resources/script.js'],
['no', 'script-src 127.0.0.1:8000/not-security', 'resources/script.js'],
['no', 'script-src 127.0.0.1:8000/security%3bnot-contentSecurityPolicy', 'resources/script.js'],
+ ['no', 'script-src 127.0.0.1:8000/security/contentSecurityPolicy/resources/', 'http://127.0.0.1:8000/security/contentSecurityPolicy/RESOURCES/script.js'],
['yes', 'script-src 127.0.0.1:*/' + security + '/', 'resources/script.js'],
['yes', 'script-src 127.0.0.1:*/security/', resources + '/script.js'],
['yes', 'script-src 127.0.0.1:*/' + security + '/', resources + '/script.js'],
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (200851 => 200852)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-05-13 13:26:37 UTC (rev 200851)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-05-13 13:29:42 UTC (rev 200852)
@@ -1,3 +1,21 @@
+2016-05-04 Daniel Bates <[email protected]>
+
+ CSP: Perform case sensitive match against path portion of source _expression_ URL that ends in '/'
+ https://bugs.webkit.org/show_bug.cgi?id=157275
+
+ Reviewed by Darin Adler.
+
+ Merged from Blink:
+ <https://chromium.googlesource.com/chromium/src/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb>
+
+ Perform a case-sensitive prefix match of the path portion a source _expression_ that ends in '/'
+ against the path portion of a request URL as per step 8.5.4 of section Does url match _expression_
+ in origin with redirect count of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp>
+ (Editor's Draft, 27 April 2016).
+
+ * page/csp/ContentSecurityPolicySource.cpp:
+ (WebCore::ContentSecurityPolicySource::pathMatches):
+
2016-05-04 Youenn Fablet <[email protected]>
Clicks inside button elements are sometimes discarded when the mouse moves
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/page/csp/ContentSecurityPolicySource.cpp (200851 => 200852)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/page/csp/ContentSecurityPolicySource.cpp 2016-05-13 13:26:37 UTC (rev 200851)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/page/csp/ContentSecurityPolicySource.cpp 2016-05-13 13:29:42 UTC (rev 200852)
@@ -76,7 +76,7 @@
String path = decodeURLEscapeSequences(url.path());
if (m_path.endsWith("/"))
- return path.startsWith(m_path, false);
+ return path.startsWith(m_path);
return path == m_path;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
