问题描述
假设我在 mywebsite.com 上设置了此标题：
Content-Security-Policy：script-src self https：//*.example.com
I知道它会允许 https://foo.example.com 和 https://bar.example.com ，但它会允许 https://example.com 单独吗？
看看 ....
...好像应该允许普通 https://example.com 。不过，我发现了几个不同的网站（，，） all 表示 https://example.com不包括。这是什么？ / p>
但部分，它定义了什么是CSP源表达式，实际上并没有说明相关的规范要求。 p>
相反，实际上确实规范地定义相关要求的CSP规范部分是，子步骤的内容如下：
前面的U + 002E FULL STOP字符（。）部分表示星号被移除后的剩余部分包括领先的句号，所以 url 的主持人最右边的字符也必须以点开头以匹配。
$ b $换句话说，如果你从 *。example.com 开始，然后遍历该算法的那部分hm，首先删除 * 以获取 .example.com 作为剩余的 部分，然后你匹配 url 的主机最右边的字符，包括前导句句。
因此， https://foo.example.com 匹配，因为其主机部分的最右侧字符匹配 .example.com ，但 https://example.com 不匹配，因为其主机部分的最右侧字符不匹配 .example。 $ b -13更新
后退，它是。
现在显示为：
请注意，读取的部分与主机或其任何子域上的任何资源匹配现在只读匹配主机子域上的任何资源。
Say I have this header set on mywebsite.com:
Content-Security-Policy: script-src self https://*.example.com
I know it will allow https://foo.example.com and https://bar.example.com, but will it allow https://example.com alone?
Looking at the spec....
...it seems as it should allow plain https://example.com. However, I've found several different sites (site 1, site 2, site 3, site 4) that all say that https://example.com isn't included. Which is it?
That text cited from the CSP spec appears to be wrong, and the other sources cited are right.
But that https://www.w3.org/TR/CSP/#source-expression section cited, which defines what a CSP source expression is, isn’t actually stating the relevant normative requirements.
Instead the section of the CSP spec that does actually normatively define the relevant requirements is the Does url match expression in origin with redirect count algorithm, in a substep at https://www.w3.org/TR/CSP/#ref-for-grammardef-host-part-2 which reads:
The including the leading U+002E FULL STOP character (.) part of the requirement indicates the remaining part after the asterisk is removed includes the leading full stop, and so the rightmost characters of url’s host must also start with a dot in order to match that.
In other words, if you start with *.example.com and walk through that part of the algorithm, you start by removing the * to get .example.com as the remaining part, and then you match the rightmost characters of url's host against that, including the leading full stop.
So https://foo.example.com matches, because the rightmost characters of its host part match .example.com, but https://example.com doesn’t match, because the rightmost characters of its host part don’t match .example.com (because it lacks the included full stop).
2017-10-13 update
A while back I reported the problem with the CSP spec and it’s now been fixed.
The relevant part of the CSP spec now reads:
Notice that the part which had read "matches any resource on the host or any of its subdomains" now just reads "matches any resource on the host’s subdomains".
这篇关于内容安全策略标头的* .example.com是否也与example.com匹配？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！