mirror of
https://github.com/morluto/rea
synced 2026-10-28 06:46:47 -04:00
Dery Ferdika
1d15bcb9ec
* fix(browser): classify CSP host sources by their own origin A Content-Security-Policy host-source without a scheme (for example `cdn.example.com` or `*.trusted.test`) was resolved with `new URL(token, baseUrl)`, so it became a page-relative path and was reported as the observed page's own origin. Third-party script, style, and connect sources were therefore misreported as approved origins, and a bare `*` wildcard collapsed to the page origin as well. Resolve host-sources per CSP3 \u00a72.3.1: a scheme-less source inherits the protected resource's scheme, wildcard host/port sources stay classified as a set of origins, and non-host tokens remain `other`. Keyword and scheme sources are unchanged. Adds boundary coverage for scheme-less host sources, wildcards, and scheme inheritance against the approved-origin set. * fix(browser): validate CSP host source syntax --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>