w3c / webappsec-csp

WebAppSec Content Security Policy
https://w3c.github.io/webappsec-csp/
Other
210 stars 78 forks source link

port-part being null is not handled #680

Open evilpie opened 2 months ago

evilpie commented 2 months ago

port-part is explicitly set to null, but port-part match doesn't handle it.

6.7.2.8. Does url match expression in origin with redirect count?

Step 3.4. Let port-part be expression’s port-part if present, and null otherwise. Step 3.5. If port-part does not port-part match url, return "Does Not Match".

port-part match

Step 1. Assert: input is the empty string, "*", or a sequence of ASCII digits.