google / csp-evaluator

https://csp-evaluator.withgoogle.com
Apache License 2.0
335 stars 46 forks source link

Support wildcard as port number #46

Closed 0xiso closed 2 years ago

0xiso commented 2 years ago

If a wildcard is used as a port number, for example default-src http://example.com:*, it will cause an error like shown below. This pull request will fix this.

> parsed = new parser.CspParser("default-src http://example.com:*").csp;
Csp { directives: { 'default-src': [ 'http://example.com:*' ] } }
> new evaluator.CspEvaluator(parsed).evaluate();
Uncaught TypeError [ERR_INVALID_URL]: Invalid URL
    at __node_internal_captureLargerStackTrace (node:internal/errors:465:5)
    at new NodeError (node:internal/errors:372:5)
    at onParseError (node:internal/url:563:9)
    at new URL (node:internal/url:643:5)
    at Object.matchWildcardUrls (/tmp/node_modules/csp_evaluator/dist/utils.js:28:20)
    at checkScriptAllowlistBypass (/tmp/node_modules/csp_evaluator/dist/checks/security_checks.js:151:37)
    at CspEvaluator.evaluate (/tmp/node_modules/csp_evaluator/dist/evaluator.js:43:50) {
  input: 'https://example.com:wildcard_placeholder',
  code: 'ERR_INVALID_URL'
}
google-cla[bot] commented 2 years ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

adalfonso commented 2 years ago

Hey, any update regarding this PR? I'm also facing this issue.

0xiso commented 2 years ago

@ddworken Could you check this PR?