diff options
Diffstat (limited to 'dom/security/nsCSPUtils.cpp')
| -rw-r--r-- | dom/security/nsCSPUtils.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp index 63b4aae2c..b074a980c 100644 --- a/dom/security/nsCSPUtils.cpp +++ b/dom/security/nsCSPUtils.cpp @@ -503,6 +503,7 @@ nsCSPSchemeSrc::toString(nsAString& outStr) const nsCSPHostSrc::nsCSPHostSrc(const nsAString& aHost) : mHost(aHost) + , mWithinFrameAncstorsDir(false) { ToLowerCase(mHost); } @@ -686,6 +687,11 @@ nsCSPHostSrc::permits(nsIURI* aUri, const nsAString& aNonce, bool aWasRedirected rv = url->GetFilePath(uriPath); NS_ENSURE_SUCCESS(rv, false); + if (mWithinFrameAncstorsDir) { + // no path matching for frame-ancestors to not leak any path information. + return true; + } + nsString decodedUriPath; CSP_PercentDecodeStr(NS_ConvertUTF8toUTF16(uriPath), decodedUriPath); |