KotJohansson/UXP
1
0
Fork 0
mirror of https://github.com/roytam1/UXP.git synced 2026-05-26 14:54:25 +00:00
Code Issues Projects Releases Wiki Activity

Don't allow cross-origin POST redirects on 308 codes.

Browse Source 
We already don't allow cross origin POST redirects on 307 redirects;
this adds extra guards to make sure we don't allow them on 308s either.
This commit is contained in:
Kyle Machulis
2019-07-20 15:27:48 +02:00
committed by Roy Tam
parent 80fc56fb93
commit b2512d610b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dom/plugins/base/nsPluginStreamListenerPeer.cpp
+2 -2
View File
@@ -1381,7 +1381,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
return NS_ERROR_FAILURE;
}
// Don't allow cross-origin 307 POST redirects.
// Don't allow cross-origin 307/308 POST redirects.
nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel));
if (oldHttpChannel) {
uint32_t responseStatus;
@@ -1389,7 +1389,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
if (NS_FAILED(rv)) {
return rv;
}
if (responseStatus == 307) {
if (responseStatus == 307 || responseStatus == 308) {
nsAutoCString method;
rv = oldHttpChannel->GetRequestMethod(method);
if (NS_FAILED(rv)) {