diff options
| -rw-r--r-- | chromium/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp | 3 | ||||
| -rw-r--r-- | chromium/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp | 29 |
2 files changed, 29 insertions, 3 deletions
diff --git a/chromium/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp b/chromium/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp index e2b6b18f654..5ddd449e9c6 100644 --- a/chromium/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp +++ b/chromium/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp @@ -92,6 +92,9 @@ bool CSPSource::portMatches(const KURL& url) const if (port == m_port) return true; + if (m_port == 80 && (port == 443 || (port == 0 && (url.protocol() == "https" || url.protocol() == "wss")))) + return true; + if (!port) return isDefaultPortForProtocol(m_port, url.protocol()); diff --git a/chromium/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp b/chromium/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp index 97cfd8e6d37..7feda4eeae8 100644 --- a/chromium/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp +++ b/chromium/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp @@ -19,7 +19,6 @@ public: : csp(ContentSecurityPolicy::create()) { } - protected: RefPtr<ContentSecurityPolicy> csp; }; @@ -69,7 +68,7 @@ TEST_F(CSPSourceTest, RedirectMatching) EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), ContentSecurityPolicy::DidNotRedirect)); } -TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) +TEST_F(CSPSourceTest, InsecureSchemeMatchesSecureScheme) { KURL base; CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSource::HasWildcard); @@ -81,7 +80,7 @@ TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/"))); } -TEST_F(CSPSourceTest, InsecureHostMatchesSecure) +TEST_F(CSPSourceTest, InsecureHostSchemeMatchesSecureScheme) { KURL base; CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWildcard, CSPSource::HasWildcard); @@ -92,4 +91,28 @@ TEST_F(CSPSourceTest, InsecureHostMatchesSecure) EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/"))); } +TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) +{ + KURL base; + CSPSource source(csp.get(), "http", "example.com", 80, "/", CSPSource::NoWildcard, CSPSource::NoWildcard); + EXPECT_TRUE(source.matches(KURL(base, "http://example.com/"))); + EXPECT_TRUE(source.matches(KURL(base, "http://example.com:80/"))); + EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443/"))); + EXPECT_TRUE(source.matches(KURL(base, "https://example.com/"))); + EXPECT_TRUE(source.matches(KURL(base, "https://example.com:80/"))); + EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443/"))); + + EXPECT_FALSE(source.matches(KURL(base, "http://example.com:8443/"))); + EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8443/"))); + + EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com/"))); + EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:80/"))); + EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:443/"))); + EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com/"))); + EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:80/"))); + EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:443/"))); +} + + + } // namespace |