Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3df73f1f9e3a5a8c5ed3891b5a4c35c8a2c95d4e
https://github.com/WebKit/WebKit/commit/3df73f1f9e3a5a8c5ed3891b5a4c35c8a2c95d4e
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked.html
M Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp
Log Message:
-----------
CSP: nonce-source and hash-source must reject trailing characters after the
closing quote
https://bugs.webkit.org/show_bug.cgi?id=318098
Reviewed by Anne van Kesteren.
ContentSecurityPolicySourceList::parseNonceSource() and parseHashSource()
verified that the byte at the current position was the closing quote, but never
verified that the quote was the *last* character of the source expression. Both
take their StringParsingBuffer by value, and the caller discards the buffer on a
true return, so any trailing characters were silently ignored. As a result a
malformed token such as
```
script-src 'nonce-abc'X
script-src 'sha256-<base64>='X
```
was accepted as the valid nonce/hash 'nonce-abc' / 'sha256-<base64>=', instead
of being treated as an invalid source expression and dropped.
Per the CSP3 grammar, nonce-source ("'nonce-" base64-value "'") and hash-source
("'" hash-algorithm "-" base64-value "'") must match a source-expression token
in its entirety; a token with characters after the closing quote is invalid and
must be ignored during parsing. The non-quoted host/scheme/port/path path
already enforces this by requiring buffer.atEnd(), so the laxity was unique to
the quoted forms.
This aligns WebKit with Blink and Gecko, both of which reject these malformed
tokens.
Consume the closing quote with skipExactly() and require buffer.atEnd()
afterwards, rejecting the source expression if any characters remain.
Test:
imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked.html:
Added.
* Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp:
(WebCore::ContentSecurityPolicySourceList::parseNonceSource):
(WebCore::ContentSecurityPolicySourceList::parseHashSource):
Canonical link: https://commits.webkit.org/316008@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
