Bug #100798
closed
CSP: wildcard is url-encoded
Added by Franz Kugelmann over 1 year ago.
Updated about 1 month ago.
Description
There is one special case with CSP directives, which is not correctly covered right now. Example:
mutations:
- mode: set
directive: 'frame-src'
sources:
- '*'
This leads to "frame-src /%2A;", effectively blocking all sources.
Especially for frame-src this global wildcard is in widespread use, since it is hard to predefine which URLs are allowed to be included in iframes.
Most probably the observation is correct. However, allowing everything contradicts the goal of content security policy - using allowed domains explicitly would be preferred. Would that be possible in your case?
- Status changed from New to Under Review
Oliver Hader wrote in #note-1:
Most probably the observation is correct. However, allowing everything contradicts the goal of content security policy - using allowed domains explicitly would be preferred. Would that be possible in your case?
Thanks for the quick response! We take the situation as call-to-action and try to create a list of allowed domains.
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
- Status changed from Resolved to Closed
Also available in: Atom
PDF