RequestPolicy/requestpolicy — Issue #103: Manual Policy Entries not honored
Author: jsamuel
Created: 2011-12-22 18:52:41+00:00
State: open
Labels: extension

imported trac ticket
created: 2010-05-10 00:28:33
reporter: eibwen

After encountering a site with round-robin image servers, eg:

www.example.com
img_1.example.com
img_2.example.com
img_3.example.com
...
img_''n''.example.com

Used the preferences dialog to add the following policies to the whitelist:

!http://www.example.com => example.com (origin-to-destination policy not honored)
www.example.com => example.com (origin-to-destination policy not honored)
example.com => example.com (origin-to-destination not policy honored)
ANY => example.com (destination policy WORKS)

Strictness setting was configured as full domain + protocol + port; however, less strict whitelist settings were only honored as a to domain policy and NOT from origin-to-domain policies. This is inconsistent behavior.

At the very least this seems to violate the principle of least surprise, particularly as the GUI did not throw any errors or warnings about ineffective policies given current settings, strictness or otherwise. Expected all of the above to work, independently of strictness setting.

The workaround is not desirable either, as it permits cross-site requests from external 2nd level domains (eg example.NET => img_3.example.COM). Specifying the policy as an origin is not desirable either, as the origin attempts to make cross-site requests to multiple external 2nd level domains.