Inconsistent support for wildcards in content security policy overrides

[dotproto]

This Twitter exchange made me realize that Chrome, Firefox, and Safari do not have a consistent approach to wildcard sources for CSP source values.

As @xeenon noted, MDN's content_security_policy docs state that "All sources must specify a host." As a result, * is not a valid source value. Both Firefox and Safari support this limitation, but Chrome does not.

A material result of this divergence is that extension authors are able to display images on extension pages from arbitrary origins in Chrome by including img-src *; in their extension's CSP, but they cannot do this in Firefox or Safari. Instead, authors targeting Firefox and safari must either manually specify all known origins in their img-src directive or use a workarounds like proxying images requests.

Public signals from browsers

• Firefox
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1752309#c3
• Safari
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1752309#c8
  • https://feedbackassistant.apple.com/feedback/8968973

[zombie]

It seems this was a documentation error on MDN (based on unclear comments in Firefox code). We don't block the wildcard * from non-script sources, see bug 1752309 comment 3 and comment 5 for more details.

We'll be fixing the wording on MDN, and can mention Safari differences unless they want to align the behavior with Chromium and Firefox.

[Rob--W]

Safari also intends to align the behavior with Chromium and Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1752309#c8

This issue can therefore be closed. In the future it may make sense to specify the desired behavior of CSP.

[carlosjeurissen]

Related Safari issue:
https://developer.apple.com/forums/thread/669889
https://feedbackassistant.apple.com/feedback/8968973

@xeenon