nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1819172 - cap max-age from HTTP Strict Transport Security headers at 100 years r=jschanck

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D172602
This commit is contained in:
Dana Keeler 2023-03-16 20:01:54 +00:00
parent 4f8bac149f
commit 0d4ea7981e
3 changed files with 12 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

8
security/manager/ssl/nsSiteSecurityService.cpp
View file

@ -557,6 +557,9 @@ static uint32_t ParseSSSHeaders(const nsCString& aHeader,
return nsISiteSecurityService::Success; return nsISiteSecurityService::Success;
} }
// 100 years is wildly longer than anyone will ever need.
const uint64_t sMaxMaxAgeInSeconds = UINT64_C(60 * 60 * 24 * 365 * 100);
nsresult nsSiteSecurityService::ProcessSTSHeader( nsresult nsSiteSecurityService::ProcessSTSHeader(
nsIURI* aSourceURI, const nsCString& aHeader, nsIURI* aSourceURI, const nsCString& aHeader,
const OriginAttributes& aOriginAttributes, uint64_t* aMaxAge, const OriginAttributes& aOriginAttributes, uint64_t* aMaxAge,
@ -590,6 +593,11 @@ nsresult nsSiteSecurityService::ProcessSTSHeader(
return NS_ERROR_FAILURE; return NS_ERROR_FAILURE;
} }
// Cap the specified max-age.
if (maxAge > sMaxMaxAgeInSeconds) {
maxAge = sMaxMaxAgeInSeconds;
}
nsAutoCString hostname; nsAutoCString hostname;
nsresult rv = GetHost(aSourceURI, hostname); nsresult rv = GetHost(aSourceURI, hostname);
NS_ENSURE_SUCCESS(rv, rv); NS_ENSURE_SUCCESS(rv, rv);

2
security/manager/ssl/tests/unit/test_sss_enumerate.js
View file

@ -5,7 +5,7 @@
do_get_profile(); // must be done before instantiating nsIX509CertDB do_get_profile(); // must be done before instantiating nsIX509CertDB
const SECS_IN_A_WEEK = 7 * 24 * 60 * 60 * 1000; const SECS_IN_A_WEEK = 7 * 24 * 60 * 60;
const TESTCASES = [ const TESTCASES = [
{ {
hostname: "a.pinning.example.com", hostname: "a.pinning.example.com",

3
security/manager/ssl/tests/unit/test_sts_parser.js
View file

@ -87,6 +87,9 @@ function run_test() {
); );
testSuccess('max-age=100; unrelated="quoted \\"thingy\\""', 100, false); testSuccess('max-age=100; unrelated="quoted \\"thingy\\""', 100, false);
// Test a max-age greater than 100 years. It will be capped at 100 years.
testSuccess("max-age=4294967296", 60 * 60 * 24 * 365 * 100, false);
// SHOULD FAIL: // SHOULD FAIL:
// invalid max-ages // invalid max-ages
testFailure("max-age"); testFailure("max-age");