Merge pull request #72 from Taym95/fix-csp-trailing-dot-host-source

Allow trailing dot CSP host-source

Author: notriddle

src/lib.rs

@@ -1925,7 +1925,8 @@ static SCHEME_SOURCE_GRAMMAR: Lazy<Regex> =
     Lazy::new(|| Regex::new(r#"^(?P<scheme>[a-zA-Z][a-zA-Z0-9\+\-\.]*):$"#).unwrap());
 /// https://www.w3.org/TR/CSP/#grammardef-host-source
 static HOST_SOURCE_GRAMMAR: Lazy<Regex> = Lazy::new(|| {
-    Regex::new(r#"^((?P<scheme>[a-zA-Z][a-zA-Z0-9\+\-\.]*)://)?(?P<host>\*|(\*\.)?[a-zA-Z0-9\-]+(\.[a-zA-Z0-9\-]+)*)(?P<port>:(\*|[0-9]+))?(?P<path>/([:@%!\$&'\(\)\*\+,;=0-9a-zA-Z\-\._~]+)?(/[:@%!\$&'\(\)\*\+,;=0-9a-zA-Z\-\._~]*)*)?$"#).unwrap()
+    // host-part   = "*" / [ "*." ] 1*host-char *( "." 1*host-char ) [ "." ]
+    Regex::new(r#"^((?P<scheme>[a-zA-Z][a-zA-Z0-9\+\-\.]*)://)?(?P<host>\*|(\*\.)?[a-zA-Z0-9\-]+(\.[a-zA-Z0-9\-]+)*\.?)(?P<port>:(\*|[0-9]+))?(?P<path>/([:@%!\$&'\(\)\*\+,;=0-9a-zA-Z\-\._~]+)?(/[:@%!\$&'\(\)\*\+,;=0-9a-zA-Z\-\._~]*)*)?$"#).unwrap()
 });
 /// https://www.w3.org/TR/CSP/#grammardef-hash-source
 static HASH_SOURCE_GRAMMAR: Lazy<Regex> = Lazy::new(|| {

tests/examples.rs

@@ -44,6 +44,12 @@ test_should_request_be_blocked! {
         policy: "connect-src https://*.notriddle.com:0443",
         dest: None,
         result: Allowed),
+    (   name: pre_request_connect_allow_trailing_dot_host_source,
+        url: "https://www.notriddle.com.:443/meta",
+        origin: "https://example.com",
+        policy: "connect-src https://www.notriddle.com.:443",
+        dest: None,
+        result: Allowed),
     (   name: pre_request_wild_script_allow,
         url: "https://www.notriddle.com/script.js",
         origin: "https://www.notriddle.com",