roytam1/UXP
1
0
Fork 0
mirror of https://github.com/roytam1/UXP.git synced 2026-05-26 13:58:49 +00:00
Code Issues Projects Releases Wiki Activity

Bug 1431095 - Change Content-Type-Options: nosniff allowed script MIME types to match the spec

Browse Source
This commit is contained in:
janekptacijarabaci
2018-04-03 19:50:55 +02:00
committed by Roy Tam
parent 83b729c6a1
commit 8f4e22e819
4 changed files with 11 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dom/base/nsContentUtils.cpp
+7 -15
View File
@@ -3716,20 +3716,6 @@ nsContentUtils::IsChildOfSameType(nsIDocument* aDoc)
return sameTypeParent != nullptr;
}
bool
nsContentUtils::IsScriptType(const nsACString& aContentType)
{
// NOTE: if you add a type here, add it to the CONTENTDLF_CATEGORIES
// define in nsContentDLF.h as well.
return aContentType.EqualsLiteral(APPLICATION_JAVASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_XJAVASCRIPT) ||
aContentType.EqualsLiteral(TEXT_ECMASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_ECMASCRIPT) ||
aContentType.EqualsLiteral(TEXT_JAVASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_JSON) ||
aContentType.EqualsLiteral(TEXT_JSON);
}
bool
nsContentUtils::IsPlainTextType(const nsACString& aContentType)
{
@@ -3739,7 +3725,13 @@ nsContentUtils::IsPlainTextType(const nsACString& aContentType)
aContentType.EqualsLiteral(TEXT_CSS) ||
aContentType.EqualsLiteral(TEXT_CACHE_MANIFEST) ||
aContentType.EqualsLiteral(TEXT_VTT) ||
IsScriptType(aContentType);
aContentType.EqualsLiteral(APPLICATION_JAVASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_XJAVASCRIPT) ||
aContentType.EqualsLiteral(TEXT_ECMASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_ECMASCRIPT) ||
aContentType.EqualsLiteral(TEXT_JAVASCRIPT) ||
aContentType.EqualsLiteral(APPLICATION_JSON) ||
aContentType.EqualsLiteral(TEXT_JSON);
}
bool
dom/base/nsContentUtils.h
+1 -6
View File
@@ -1018,12 +1018,7 @@ public:
static bool IsChildOfSameType(nsIDocument* aDoc);
/**
'* Returns true if the content-type is any of the supported script types.
*/
static bool IsScriptType(const nsACString& aContentType);
/**
'* Returns true if the content-type will be rendered as plain-text.
* Returns true if the content-type will be rendered as plain-text.
*/
static bool IsPlainTextType(const nsACString& aContentType);
netwerk/protocol/http/nsHttpChannel.cpp
+1 -1
View File
@@ -1152,7 +1152,7 @@ ProcessXCTO(nsIURI* aURI, nsHttpResponseHead* aResponseHead, nsILoadInfo* aLoadI
}
if (aLoadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SCRIPT) {
if (nsContentUtils::IsScriptType(contentType)) {
if (nsContentUtils::IsJavascriptMIMEType(NS_ConvertUTF8toUTF16(contentType))) {
return NS_OK;
}
ReportTypeBlocking(aURI, aLoadInfo, "MimeTypeMismatch");
testing/web-platform/tests/fetch/nosniff/script.html
+2 -2
View File
@@ -4,8 +4,8 @@
<script>
var log = function() {}, // see comment below
p = function() {}, // see comment below
fails = ["", "?type=", "?type=x", "?type=x/x"],
passes = ["?type=text/javascript", "?type=text/ecmascript", "?type=text/ecmascript;blah"]
fails = ["", "?type=", "?type=x", "?type=x/x", "?type=text/json"],
passes = ["?type=text/javascript", "?type=text/ecmascript", "?type=text/ecmascript;blah", "?type=text/javascript1.0"]
// Ideally we'd also check whether the scripts in fact execute, but that would involve
// timers and might get a bit racy without cross-browser support for the execute events.