fix(sri): compare exact origin instead of registrable domain - #559
Open
caugner wants to merge 5 commits into
Open
fix(sri): compare exact origin instead of registrable domain#559caugner wants to merge 5 commits into
caugner wants to merge 5 commits into
Conversation
The subresource integrity test treated any host on the site's registrable domain (eTLD+1, via `tldts`) plus scheme as an equivalent origin, so a script from a different subdomain (`cdn.example.com`, `evil.example.com`) was exempted from the SRI penalty as if it were same-origin. Compare the script's exact origin (scheme + host + port) against the origin the page was served from, so a different subdomain counts as a distinct, foreign origin. This drops the last use of `tldts` and removes a redundant `sameSecondLevelDomain` branch that produced the same result as its successor.
`tldts` was only used by the subresource integrity test, which no longer resolves registrable domains.
Classify each script-URL kind explicitly: a full URL compares exact origins, a relative URL is same-origin, and a protocol-relative URL is treated as a foreign origin (its risk is scored separately). With every branch setting the flag, the `secureOrigin` check no longer needs the `!relativeProtocol` special case and collapses to `relativeOrigin || sameOrigin`. No behavior change.
The redirect branch of `baseUrl` was untested because the helper leaves `redirectHistory` empty. Assert that a script foreign to the requested origin is treated as same-origin once the page redirects to that script's host.
caugner
force-pushed
the
558-sri-same-origin
branch
from
July 15, 2026 19:41
6eef72b to
c5108d9
Compare
caugner
marked this pull request as ready for review
July 15, 2026 19:47
caugner
added a commit
that referenced
this pull request
Jul 15, 2026
…th-https Rebuild the protocol-relative URL handling (issue #464) on top of the exact-origin SRI model from #559. - Drop all `tldts` usage; the origin dimension now compares the resolved script `origin` against the page's `baseOrigin` (scheme + host + port). - Collapse the per-branch origin computation to a single `new URL(scriptSrc, baseUrl).origin === baseOrigin`, guarded on `baseUrl` so a missing session resolves to a foreign origin. Same-host protocol-relative URLs are therefore same-origin. - Keep the scheme dimension (`httpEnforcesHttps` and the `relativeProtocol && httpEnforcesHttps` clause) unchanged. - Update tests for exact-origin semantics: `//www.mozilla.org` against apex `mozilla.org` is now off-origin (scored by scheme), and the on-origin path uses a new same-host `//mozilla.org` fixture.
LeoMcA
requested changes
Aug 17, 2026
| // scored separately (issue #464). | ||
| relativeProtocol = true; | ||
| sameSecondLevelDomain = true; | ||
| sameOrigin = false; |
Member
There was a problem hiding this comment.
This is wrong: a relative protocol can be the same origin - if we want to skip scoring for relative protocols here we should do so in the if statement on L115 with a !relativeProtocol check
| // Check to see if it is the same origin | ||
| let secureOrigin; | ||
| if (relativeOrigin || (sameSecondLevelDomain && !relativeProtocol)) { | ||
| if (relativeOrigin || sameOrigin) { |
Member
There was a problem hiding this comment.
The relativeOrigin = true branch also sets sameOrigin = true, so can this be:
Suggested change
| if (relativeOrigin || sameOrigin) { | |
| if (sameOrigin) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix the subresource integrity test to treat a script's exact origin (scheme + host + port) as the equivalence check, instead of the site's registrable domain (eTLD+1) plus scheme.
new URL(scriptSrc).originagainst the origin the page was served from.cdn.example.comvs.example.com) now counts as a distinct, foreign origin.tldtsdependency and a redundantsameSecondLevelDomainbranch.Motivation
Ensure the SRI test reflects the same-origin policy. Treating any host on the registrable domain as same-origin exempted cross-origin scripts (subdomain takeover, delegated/vendor-hosted subdomains) from the SRI penalty — the very resources SRI is meant to protect. Raised by the security team.
Additional details
test_content_sri_sameorigin2.htmlpreviously loaded fromhttps://www.mozilla.org/…while the page origin ishttps://mozilla.organd relied on the registrable-domain equivalence to be considered same-origin; it now loads from the page's own origin. A new test asserts a different subdomain is penalized as an external (secure) origin. A second test asserts the base origin follows the final redirect (a script on the post-redirect host is treated as same-origin).Related issues and pull requests
Fixes #558.