CSP report-uri and policy-uri directives are relative to current URL rather than to base URL [#2091627]

Comment	File	Size	Author
#1	seckit-base_path-2091627-1.patch	472 bytes	jweowu

Comment #1

jweowu CreditAttribution: jweowu commented 17 September 2013 at 23:45

Status:

Active

» Needs review

File	Size
seckit-base_path-2091627-1.patch	472 bytes

Log in or register to post comments

Comment #2

jweowu CreditAttribution: jweowu commented 17 September 2013 at 23:47

Title:

report-uri header is relative

» CSP report-uri directive is relative

Log in or register to post comments

Comment #3

p0deje CreditAttribution: p0deje commented 18 September 2013 at 13:22

Assigned:	Unassigned	» p0deje
Status:	Needs review	» Needs work

@jweowu Thanks for both bug report and patch. Could you please also add a regression test for this (if it is possible)?

Log in or register to post comments

Comment #4

p0deje CreditAttribution: p0deje commented 18 September 2013 at 13:31

Nevermind, I think it is not testable with SimpleTest

Log in or register to post comments

Comment #5

p0deje CreditAttribution: p0deje commented 18 September 2013 at 13:49

Status:

Needs work

» Fixed

Thanks for patch, applied and release as 1.7

Log in or register to post comments

Comment #6

jweowu CreditAttribution: jweowu commented 20 September 2013 at 00:05

I'm not using a policy file, but I guess this change needs to happen for policy-uri as well?

(And while you're looking at this function, there's an extra space in the img-src string.)

Edit: And while I'm mentioning trivial formatting in general :) There's a code-formatting glitch at the end of this #description:

diff --git a/sites/all/modules/contrib/seckit/includes/seckit.form.inc b/sites/all/modules/contrib/seckit/includes/seckit.form.inc
index 581a643..95c016d 100644
--- a/sites/all/modules/contrib/seckit/includes/seckit.form.inc
+++ b/sites/all/modules/contrib/seckit/includes/seckit.form.inc
@@ -145,7 +145,8 @@ function seckit_admin_form() {
     '#type' => 'textfield',
     '#default_value' => $options['seckit_xss']['csp']['policy-uri'],
     '#title' => 'policy-uri',
-    '#description' => t("Specify URI to a file containing the policy. It should be text/x-content-security-policy content-type. Note, that policy-uri must only be declated when no other policies are specified. Otherwise, user-agent enforces default-src 'none'. Thus, other directives will be ignored by Security Kit."),);
+    '#description' => t("Specify URI to a file containing the policy. It should be text/x-content-security-policy content-type. Note, that policy-uri must only be declated when no other policies are specified. Otherwise, user-agent enforces default-src 'none'. Thus, other directives will be ignored by Security Kit."),
+  );