csper-io / csp-generator

Browser extension for Generating Content Security Policy (CSP)
https://addons.mozilla.org/en-US/firefox/addon/csp-generator/
11 stars 4 forks source link

Chrome+Firefox - Interception fails on non http(s) ports #2

Open wadabum opened 2 years ago

wadabum commented 2 years ago

http://www.examle.com/ gets intercepted and reports as expected

http://www.examle.com:8080/ asks Are you ready to build a policy for: www.examle.com:8080?
But then no actual interception is happening (console is silent)

If i had to guess:

I would blame getCurrentDomain() that does NOT include the port, while the interna .domain (as used in the start-template) does seem to have the port in it?

but this is purely speculative^^

tested in latest-Chrome as well as latest-Firefox with the current store-versions of the extension

wadabum commented 2 years ago

After digging a little deeper, this certainly is a miss match on what is stored vs what is checked midflight devtools breakpoint and jumped one step

Fix might be as simple as flipping window.location.hostname to window.location.host?

wadabum commented 2 years ago

I can now confirm that

> - let domain = new URL(details.url).hostname;
> + let domain = new URL(details.url).host

fixes Firefox.

(tested in dev-edition, so modified the background-script in the xpi)

If you could implement this and rebuild/publish the extension this would be highly appreciated @c0nrad tested it to still work fine with "urls without port" for http as well as https too.

c0nrad commented 2 years ago

Hey @wadabum , thanks for much for this detailed investigation! I'm on vacation this week, but I will take a look and submit the new extension when I get back on Monday.

Thanks again

edobudim commented 2 years ago

Hi, I found this extension very useful, but it stopped working. It was working month or two ago, but now it is not generating policies at all. I've tried both extensions for Chrome and Firefox and they both are failing/ Do you plan to fix the problem and when? Thank you in advance