CSP doesn't work for a wide variety of cases

https://bugs.webkit.org/show_bug.cgi?id=68921

Reviewed by Darin Adler.

Patch suggested by Sam Weinig.  It's unclear to me how to test this
change because all our tests run on non-default ports, which is why we
have this bug in the first place.  Mozilla uses a proxy while testing
so they can test with URLs like http://example.com, but we don't have
such a facility.

* page/ContentSecurityPolicy.cpp:
(WebCore::CSPSource::portMatches):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@96239 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 4de3b19..6741f3c 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2011-09-28  Adam Barth  <abarth@webkit.org>
+
+        CSP doesn't work for a wide variety of cases
+        https://bugs.webkit.org/show_bug.cgi?id=68921
+
+        Reviewed by Darin Adler.
+
+        Patch suggested by Sam Weinig.  It's unclear to me how to test this
+        change because all our tests run on non-default ports, which is why we
+        have this bug in the first place.  Mozilla uses a proxy while testing
+        so they can test with URLs like http://example.com, but we don't have
+        such a facility.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPSource::portMatches):
+
 2011-09-28  Fady Samuel  <fsamuel@chromium.org>
 
         [Chromium] Seperate GTK specific Gyp rules from X11 Gyp rules

diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 805efbd..0b1c6c8 100644 (file)
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -147,8 +147,19 @@ private:
     {
         if (m_portHasWildcard)
             return true;
+
         int port = url.port();
-        return port ? port == m_port : isDefaultPortForProtocol(m_port, url.protocol());
+
+        if (port == m_port)
+            return true;
+
+        if (!port)
+            return isDefaultPortForProtocol(m_port, m_scheme);
+
+        if (!m_port)
+            return isDefaultPortForProtocol(port, m_scheme);
+
+        return false;
     }
 
     bool isSchemeOnly() const { return m_host.isEmpty(); }