Paths and Redirects

hi *,

in [0] I see a section that has been written in order to address the issue spotted by Egor Homakov in [1].
Now I might have well misunderstood the all story but IMHO this doesn’t seem to solve the original issue.
E.g. if we have

img-src<http://www.w3.org/TR/CSP11/#img-src> example.com<http://example.com>

rahter than

img-src<http://www.w3.org/TR/CSP11/#img-src> example.com<http://example.com> not-example.com/path<http://not-example.com/path>

what is going to happen?
AFAIU the redirect to not-example.com<http://not-example.com> will still happens hence the leaking.

regards

antonio

[0] http://www.w3.org/TR/CSP11/#source-list-paths-and-redirects
[1] http://homakov.blogspot.de/2014/01/using-content-security-policy-for-evil.html

Received on Saturday, 16 August 2014 22:12:37 UTC