Skip to content

Commit 5233fe8

Browse files
mikewestmikewest
committed
CSP2: Note the issue the 'CSP' header was meant to solve.
1 parent 245c10b commit 5233fe8

File tree

3 files changed

+46
-6
lines changed

3 files changed

+46
-6
lines changed

‎specs/CSP2/index.html

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@
111111
<h1 class="p-name no-ref" id="title">Content Security Policy Level 2</h1>
112112

113113
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft,
114-
<time class="dt-updated" datetime="2015-08-11">11 August 2015</time></span></h2>
114+
<time class="dt-updated" datetime="2015-08-12">12 August 2015</time></span></h2>
115115

116116
<div data-fill-with="spec-metadata">
117117
<dl>
@@ -346,7 +346,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="contents"><span class="cont
346346
<li><a href="#security-considerations"><span class="secno">9</span> <span class="content">Security Considerations</span></a>
347347
<ul class="toc">
348348
<li><a href="#security-css-parsing"><span class="secno">9.1</span> <span class="content">Cascading Style Sheet (CSS) Parsing</span></a>
349-
<li><a href="#security-violation-reports"><span class="secno">9.2</span> <span class="content">Violation Reports</span></a>
349+
<li><a href="#security-redirects"><span class="secno">9.2</span> <span class="content">Redirect Information Leakage</span></a>
350350
</ul>
351351
<li><a href="#implementation-considerations"><span class="secno">10</span> <span class="content">Implementation Considerations</span></a>
352352
<ul class="toc">
@@ -4963,7 +4963,7 @@ <h3 class="heading settled" data-level="9.1" id="security-css-parsing"><span cla
49634963

49644964
<section>
49654965

4966-
<h3 class="heading settled" data-level="9.2" id="security-violation-reports"><span class="secno">9.2. </span><span class="content">Violation Reports</span><a class="self-link" href="#security-violation-reports"></a></h3>
4966+
<h3 class="heading settled" data-level="9.2" id="security-redirects"><span class="secno">9.2. </span><span class="content">Redirect Information Leakage</span><a class="self-link" href="#security-redirects"></a></h3>
49674967

49684968

49694969

@@ -4980,6 +4980,20 @@ <h3 class="heading settled" data-level="9.2" id="security-violation-reports"><sp
49804980
such as session identifiers or purported identities. For this reason, the
49814981
user agent includes only the origin of the blocked URL.</p>
49824982

4983+
4984+
4985+
<p>The mitigations are not complete, however: redirects which are blocked will
4986+
produce side-effects which may be visible to JavaScript (via
4987+
<code>img.naturalHeight</code>, for instance). An earlier version of this
4988+
specification defined a
4989+
<a href="http://www.w3.org/TR/2015/CR-CSP2-20150721/#csp-request-header"><code>CSP</code>
4990+
request header</a> which servers could use (in conjunction with the
4991+
<code>referer</code> and <code>origin</code> headers) to determine whether
4992+
or not it was completely safe to redirect a user. This header caused some
4993+
issues with CORS processing (tracked in
4994+
<a href="https://github.com/whatwg/fetch/issues/52">whatwg/fetch#52</a>),
4995+
and has been punted to the next version of this document.</p>
4996+
49834997

49844998
</section>
49854999
</section>

‎specs/CSP2/index.src.html

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3403,7 +3403,7 @@ <h3 id="security-css-parsing">Cascading Style Sheet (CSS) Parsing</h3>
34033403
</section>
34043404

34053405
<section>
3406-
<h3 id="security-violation-reports">Violation Reports</h3>
3406+
<h3 id="security-redirects">Redirect Information Leakage</h3>
34073407

34083408
The violation reporting mechanism in this document has been
34093409
designed to mitigate the risk that a malicious web site could use
@@ -3417,6 +3417,18 @@ <h3 id="security-violation-reports">Violation Reports</h3>
34173417
report might contain sensitive information contained in the redirected URL,
34183418
such as session identifiers or purported identities. For this reason, the
34193419
user agent includes only the origin of the blocked URL.
3420+
3421+
The mitigations are not complete, however: redirects which are blocked will
3422+
produce side-effects which may be visible to JavaScript (via
3423+
<code>img.naturalHeight</code>, for instance). An earlier version of this
3424+
specification defined a
3425+
<a href="http://www.w3.org/TR/2015/CR-CSP2-20150721/#csp-request-header"><code>CSP</code>
3426+
request header</a> which servers could use (in conjunction with the
3427+
<code>referer</code> and <code>origin</code> headers) to determine whether
3428+
or not it was completely safe to redirect a user. This header caused some
3429+
issues with CORS processing (tracked in
3430+
<a href="https://github.com/whatwg/fetch/issues/52">whatwg/fetch#52</a>),
3431+
and has been punted to the next version of this document.
34203432
</section>
34213433
</section>
34223434

‎specs/CSP2/published/2015-08-PR.html

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="contents"><span class="cont
307307
<li><a href="#security-considerations"><span class="secno">9</span> <span class="content">Security Considerations</span></a>
308308
<ul class="toc">
309309
<li><a href="#security-css-parsing"><span class="secno">9.1</span> <span class="content">Cascading Style Sheet (CSS) Parsing</span></a>
310-
<li><a href="#security-violation-reports"><span class="secno">9.2</span> <span class="content">Violation Reports</span></a>
310+
<li><a href="#security-redirects"><span class="secno">9.2</span> <span class="content">Redirect Information Leakage</span></a>
311311
</ul>
312312
<li><a href="#implementation-considerations"><span class="secno">10</span> <span class="content">Implementation Considerations</span></a>
313313
<ul class="toc">
@@ -4924,7 +4924,7 @@ <h3 class="heading settled" data-level="9.1" id="security-css-parsing"><span cla
49244924

49254925
<section>
49264926

4927-
<h3 class="heading settled" data-level="9.2" id="security-violation-reports"><span class="secno">9.2. </span><span class="content">Violation Reports</span><a class="self-link" href="#security-violation-reports"></a></h3>
4927+
<h3 class="heading settled" data-level="9.2" id="security-redirects"><span class="secno">9.2. </span><span class="content">Redirect Information Leakage</span><a class="self-link" href="#security-redirects"></a></h3>
49284928

49294929

49304930

@@ -4941,6 +4941,20 @@ <h3 class="heading settled" data-level="9.2" id="security-violation-reports"><sp
49414941
such as session identifiers or purported identities. For this reason, the
49424942
user agent includes only the origin of the blocked URL.</p>
49434943

4944+
4945+
4946+
<p>The mitigations are not complete, however: redirects which are blocked will
4947+
produce side-effects which may be visible to JavaScript (via
4948+
<code>img.naturalHeight</code>, for instance). An earlier version of this
4949+
specification defined a
4950+
<a href="http://www.w3.org/TR/2015/CR-CSP2-20150721/#csp-request-header"><code>CSP</code>
4951+
request header</a> which servers could use (in conjunction with the
4952+
<code>referer</code> and <code>origin</code> headers) to determine whether
4953+
or not it was completely safe to redirect a user. This header caused some
4954+
issues with CORS processing (tracked in
4955+
<a href="https://github.com/whatwg/fetch/issues/52">whatwg/fetch#52</a>),
4956+
and has been punted to the next version of this document.</p>
4957+
49444958

49454959
</section>
49464960
</section>

0 commit comments

Comments
 (0)