More bugfixes, don't match plain host names for now

src/parsers/manifestjson.js

@@ -175,7 +175,7 @@ export default class ManifestJSONParser extends JSONParser {
 
     // Not sure about FTP here but CSP spec treats ws/wss as
     // equivalent to http/https.
-    const validProtocols = ['ftp:', 'http:', 'https:', 'ws:', 'wss'];
+    const validProtocols = ['ftp:', 'http:', 'https:', 'ws:', 'wss:'];
 
     for (const candidate of ['script-src', 'default-src']) {
       if (directives.hasOwnProperty(candidate)) {
@@ -197,25 +197,15 @@ export default class ManifestJSONParser extends JSONParser {
             // so we have to match this a bit wider. This will work since
             // 'self' and others are required to include the quotes (afair)
             // which results in an invalid URL.
+
             if (validProtocols.includes(url.protocol)) {
               this.collector.addWarning(messages.MANIFEST_CSP);
-              continue;
             }
           } catch (e) {
-            if (value.trim().includes('*')) {
-              this.collector.addWarning(messages.MANIFEST_CSP);
-
-              continue;
-            }
-
-            // values like 'ws:' or 'http:' are valid values but aren't correct
-            // URLs so the try/catch above will fail and we'll have to string
-            // manually.
-            if (validProtocols.includes(value.trim())) {
+            if (value.includes('*')) {
               this.collector.addWarning(messages.MANIFEST_CSP);
             }
           }
-
         }
       }
     }

tests/parsers/test.manifestjson.js

@@ -345,8 +345,6 @@ describe('ManifestJSONParser', function() {
     });
 
     it('should warn on invalid values according to Add-On Policies', () => {
-      var addonLinter = new Linter({_: ['bar']});
-
       const invalidValues = [
         'default-src *',
         'default-src moz-extension: *',
@@ -355,8 +353,6 @@ describe('ManifestJSONParser', function() {
         'default-src http:',
         'default-src https:',
         'default-src ftp:',
-        'default-src web.example.com:443',
-        'default-src web.example.com:80',
         'default-src http://cdn.example.com/my.js',
         'default-src https://cdn.example.com/my.js',
 
@@ -367,8 +363,6 @@ describe('ManifestJSONParser', function() {
         'script-src http:',
         'script-src https:',
         'script-src ftp:',
-        'script-src web.example.com:443',
-        'script-src web.example.com:80',
         'script-src http://cdn.example.com/my.js',
         'script-src https://cdn.example.com/my.js',
 
@@ -377,23 +371,23 @@ describe('ManifestJSONParser', function() {
       ];
 
       for (const invalidValue of invalidValues) {
-        var json = validManifestJSON({
+        const addonLinter = new Linter({_: ['bar']});
+
+        const json = validManifestJSON({
           content_security_policy: invalidValue,
         });
 
-        var manifestJSONParser = new ManifestJSONParser(
+        const manifestJSONParser = new ManifestJSONParser(
           json, addonLinter.collector);
 
         expect(manifestJSONParser.isValid).toEqual(true);
-        var warnings = addonLinter.collector.warnings;
+        const warnings = addonLinter.collector.warnings;
         expect(warnings[0].code).toEqual(messages.MANIFEST_CSP.code);
         expect(warnings[0].message).toContain('content_security_policy');
       }
     });
 
     it('should not warn on valid values according to Add-On Policies', () => {
-      var addonLinter = new Linter({_: ['bar']});
-
       const validValues = [
         'default-src moz-extension:',
         'script-src moz-extension:',
@@ -404,6 +398,7 @@ describe('ManifestJSONParser', function() {
         'default-src web.example.com:80',
         'script-src web.example.com',
         'script-src web.example.com:80',
+        'default-src web.example.com:443',
 
         // Mix with other directives, properly match anyway.
         'script-src \'self\'; object-src \'self\'',
@@ -414,11 +409,13 @@ describe('ManifestJSONParser', function() {
       ];
 
       for (const validValue of validValues) {
-        var json = validManifestJSON({
+        const addonLinter = new Linter({_: ['bar']});
+
+        const json = validManifestJSON({
           content_security_policy: validValue,
         });
 
-        var manifestJSONParser = new ManifestJSONParser(
+        const manifestJSONParser = new ManifestJSONParser(
           json, addonLinter.collector);
 
         expect(manifestJSONParser.isValid).toEqual(true);