Skip to content

Commit 0dc7fee

Browse files
authored
Merge pull request #478 from keithamus/do-not-dedupe-alternate-schema-source-expresions
do not dedupe alternate schema source expresions
2 parents 034c8b6 + 78cb949 commit 0dc7fee

File tree

2 files changed

+7
-1
lines changed

2 files changed

+7
-1
lines changed

lib/secure_headers/headers/content_security_policy.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,9 +155,10 @@ def dedup_source_list(sources)
155155
wild_sources = sources.select { |source| source =~ STAR_REGEXP }
156156

157157
if wild_sources.any?
158+
schemes = sources.map { |source| [source, URI(source).scheme] }.to_h
158159
sources.reject do |source|
159160
!wild_sources.include?(source) &&
160-
wild_sources.any? { |pattern| File.fnmatch(pattern, source) }
161+
wild_sources.any? { |pattern| schemes[pattern] == schemes[source] && File.fnmatch(pattern, source) }
161162
end
162163
else
163164
sources

spec/lib/secure_headers/headers/content_security_policy_spec.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,11 @@ module SecureHeaders
106106
expect(csp.value).to eq("default-src example.org")
107107
end
108108

109+
it "does not deduplicate non-matching schema source expressions" do
110+
csp = ContentSecurityPolicy.new(default_src: %w(*.example.org wss://example.example.org))
111+
expect(csp.value).to eq("default-src *.example.org wss://example.example.org")
112+
end
113+
109114
it "creates maximally strict sandbox policy when passed no sandbox token values" do
110115
csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: [])
111116
expect(csp.value).to eq("default-src example.org; sandbox")

0 commit comments

Comments
 (0)