Repository: shapesecurity/salvation (java)

Issue:
plugin-types directive should not accept wildcards
Currently, we do accept wildcards: https://cspvalidator.org/#headerValue%5B%5D=plugin-types+*%2F*&strategy=intersection

Pull request:
Warn about asterisk being used in media type.
fixes #181

Patch:
diff --git a/src/main/java/com/shapesecurity/salvation/Constants.java b/src/main/java/com/shapesecurity/salvation/Constants.java
index a710be3..6ece263 100644
--- a/src/main/java/com/shapesecurity/salvation/Constants.java
+++ b/src/main/java/com/shapesecurity/salvation/Constants.java
@@ -14,7 +14,9 @@ import java.util.regex.Pattern;
             + "|scripts|top-navigation)$");
     public static final Pattern requireSriForEnumeratedTokenPattern = Pattern
             .compile("^(?:script|style)$", Pattern.CASE_INSENSITIVE);
-    public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[^/]+)/(?<subtype>[^/]+)$");
+
+    // RFC 2045 appendix A: productions of type and subtype
+    public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)/(?<subtype>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)$");
     public static final Pattern unquotedKeywordPattern = Pattern.compile("^(?:self|unsafe-inline|unsafe-eval|unsafe-redirect|none|strict-dynamic)$");
     // port-part constants
     public static final int WILDCARD_PORT = -200;
diff --git a/src/main/java/com/shapesecurity/salvation/Parser.java b/src/main/java/com/shapesecurity/salvation/Parser.java
index d2cc6f8..b382a11 100644
--- a/src/main/java/com/shapesecurity/salvation/Parser.java
+++ b/src/main/java/com/shapesecurity/salvation/Parser.java
@@ -252,6 +252,8 @@ public class Parser {
                     if (mediaTypes.isEmpty()) {
                         this.error(token, "The media-type-list must contain at least one media-type.");
                         throw INVALID_MEDIA_TYPE_LIST;
+                    } else if (mediaTypes.stream().anyMatch(x -> x.type.equals("*") || x.subtype.equals("*"))) {
+                        this.warn(token,"Media types can only be matched literally. Make sure using `*` is not an oversight.");
                     }
                     result = new PluginTypesDirective(mediaTypes);
                     break;


Test patch:
diff --git a/src/test/java/com/shapesecurity/salvation/ParserTest.java b/src/test/java/com/shapesecurity/salvation/ParserTest.java
index 4063bfd..25ea600 100644
--- a/src/test/java/com/shapesecurity/salvation/ParserTest.java
+++ b/src/test/java/com/shapesecurity/salvation/ParserTest.java
@@ -315,6 +315,11 @@ public class ParserTest extends CSPTest {
         assertEquals(1, notices.size());
         assertEquals("The media-type-list must contain at least one media-type.", notices.get(0).message);
 
+        notices.clear();
+        parseWithNotices("plugin-types */* a/a", notices);
+        assertEquals(1, notices.size());
+        assertEquals("Media types can only be matched literally. Make sure using `*` is not an oversight.", notices.get(0).message);
+
         notices.clear();
         // XXX: technically allowed via ietf-token if an RFC introduces a type/subtype that is empty
         parseWithNotices("plugin-types /", notices);