Fix hyphen disallowed in Suborigin names

According to the proposed spec, Suborigin names should allow alphanumeric characters and hyphens. This fixes a bug where hyphens were disallowed, and it adds tests to verify the behavior. BUG=568755 [email protected] Review URL: https://codereview.chromium.org/1620393002 Cr-Commit-Position: refs/heads/master@{#371381}
crosswalk-project · Jan 26, 2016 · 45a6c69 · 45a6c69
1 parent e1758d3
commit 45a6c69
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/...arty/WebKit/LayoutTests/http/tests/security/suborigins/suborigin-valid-names-expected.txt b/...arty/WebKit/LayoutTests/http/tests/security/suborigins/suborigin-valid-names-expected.txt
@@ -3,4 +3,7 @@ ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from a
 ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
 ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
 ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
+ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
+ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
+ALERT: SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/suborigins/suborigin-valid-names.html b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/suborigin-valid-names.html
@@ -21,6 +21,9 @@
     "Foobar",
     "FOOBAR",
     "42",
+    "foo-bar",
+    "-foobar",
+    "foobar-"
 ];
 
 var iframe;

diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
@@ -34,6 +34,11 @@ String getSha256String(const String& content)
     return "sha256-" + base64Encode(reinterpret_cast<char*>(digest.data()), digest.size(), Base64DoNotInsertLFs);
 }
 
+template<typename CharType> inline bool isASCIIAlphanumericOrHyphen(CharType c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
 } // namespace
 
 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
@@ -719,7 +724,7 @@ String CSPDirectiveList::parseSuboriginName(const String& policy)
 
     const UChar* begin = position;
 
-    skipWhile<UChar, isASCIIAlphanumeric>(position, end);
+    skipWhile<UChar, isASCIIAlphanumericOrHyphen>(position, end);
     if (position != end && !isASCIISpace(*position)) {
         m_policy->reportInvalidSuboriginFlags("Invalid character \'" + String(position, 1) + "\' in suborigin.");
         return String();