Error code: NS_ERROR_NET_INADEQUATE_SECURITY
"> diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index a4dcf3ade5..34f394d937 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -522,8 +522,9 @@ SendPing(void* aClosure, nsIContent* aContent, nsIURI* aURI, return; } - // Don't bother caching the result of this URI load. - chan->SetLoadFlags(nsIRequest::INHIBIT_CACHING); + // Don't bother caching the result of this URI load, but do not exempt + // it from Safe Browsing. + chan->SetLoadFlags(nsIRequest::INHIBIT_CACHING | nsIChannel::LOAD_CLASSIFY_URI); nsCOMPtrError code: NS_ERROR_NET_INADEQUATE_SECURITY
"> diff --git a/dom/workers/test/file_getcookie.sjs b/dom/workers/test/file_getcookie.sjs new file mode 100644 index 0000000000..b5204bdd71 --- /dev/null +++ b/dom/workers/test/file_getcookie.sjs @@ -0,0 +1,15 @@ +/* Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ */ +function handleRequest(request, response) { + try { + var cookie = request.getHeader("Cookie"); + } catch (e) { + cookie = "EMPTY_COOKIE"; + } + + // avoid confusing cache behaviors. + response.setHeader("Cache-Control", "no-cache", false); + response.setHeader("Content-type", "text/plain", false); + response.setStatusLine(request.httpVersion, "200", "OK"); + response.write(cookie); +} diff --git a/dom/workers/test/mochitest.ini b/dom/workers/test/mochitest.ini index d0f31ea60c..c8f5ffa470 100644 --- a/dom/workers/test/mochitest.ini +++ b/dom/workers/test/mochitest.ini @@ -25,6 +25,7 @@ support-files = eventDispatch_worker.js fibonacci_worker.js file_bug1010784_worker.js + file_getcookie.sjs importScripts_worker.js importScripts_worker_imported1.js importScripts_worker_imported2.js @@ -236,6 +237,7 @@ skip-if = buildapp == 'b2g' || toolkit == 'android' #bug 982828 [test_workersDisabled.html] [test_xhr.html] [test_xhr2.html] +[test_xhr_3rdparty.html] [test_xhr_headers.html] [test_xhr_implicit_cancel.html] [test_xhr_parameters.html] diff --git a/dom/workers/test/test_xhr_3rdparty.html b/dom/workers/test/test_xhr_3rdparty.html new file mode 100644 index 0000000000..eeb6ef88c8 --- /dev/null +++ b/dom/workers/test/test_xhr_3rdparty.html @@ -0,0 +1,74 @@ + + + + + ++ ++ + diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp index 3db29a7753..ba0cc88e8e 100644 --- a/netwerk/base/LoadInfo.cpp +++ b/netwerk/base/LoadInfo.cpp @@ -50,7 +50,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal, , mParentOuterWindowID(0) , mEnforceSecurity(false) , mInitialSecurityCheckDone(false) - , mIsThirdPartyContext(true) + , mIsThirdPartyContext(false) , mForcePreflight(false) , mIsPreflight(false) , mIsFromProcessingFrameAttributes(false) @@ -58,6 +58,12 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal, MOZ_ASSERT(mLoadingPrincipal); MOZ_ASSERT(mTriggeringPrincipal); + // TODO(bug 1259873): Above, we initialize mIsThirdPartyContext to false meaning + // that consumers of LoadInfo that don't pass a context or pass a context from + // which we can't find a window will default to assuming that they're 1st + // party. It would be nice if we could default "safe" and assume that we are + // 3rd party until proven otherwise. + // if consumers pass both, aLoadingContext and aLoadingPrincipal // then the loadingPrincipal must be the same as the node's principal MOZ_ASSERT(!aLoadingContext || !aLoadingPrincipal || diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp index 394b383d94..6603cb4dd1 100644 --- a/netwerk/protocol/http/Http2Session.cpp +++ b/netwerk/protocol/http/Http2Session.cpp @@ -151,6 +151,8 @@ Http2Session::Shutdown() CloseStream(stream, NS_ERROR_NET_RESET); // can be restarted } else if (stream->RecvdData()) { CloseStream(stream, NS_ERROR_NET_PARTIAL_TRANSFER); + } else if (mGoAwayReason == INADEQUATE_SECURITY) { + CloseStream(stream, NS_ERROR_NET_INADEQUATE_SECURITY); } else { CloseStream(stream, NS_ERROR_ABORT); } @@ -2270,8 +2272,14 @@ Http2Session::ReadSegmentsAgain(nsAHttpSegmentReader *reader, "Inconsistent Write Function Callback"); nsresult rv = ConfirmTLSProfile(); - if (NS_FAILED(rv)) + if (NS_FAILED(rv)) { + if (mGoAwayReason == INADEQUATE_SECURITY) { + LOG3(("Http2Session::ReadSegments %p returning INADEQUATE_SECURITY %x", + this, NS_ERROR_NET_INADEQUATE_SECURITY)); + rv = NS_ERROR_NET_INADEQUATE_SECURITY; + } return rv; + } if (reader) mSegmentReader = reader; diff --git a/toolkit/components/url-classifier/tests/mochitest/ping.sjs b/toolkit/components/url-classifier/tests/mochitest/ping.sjs new file mode 100644 index 0000000000..37a78956e0 --- /dev/null +++ b/toolkit/components/url-classifier/tests/mochitest/ping.sjs @@ -0,0 +1,16 @@ +function handleRequest(request, response) +{ + var query = {}; + request.queryString.split('&').forEach(function (val) { + var [name, value] = val.split('='); + query[name] = unescape(value); + }); + + if (request.method == "POST") { + setState(query["id"], "ping"); + } else { + var value = getState(query["id"]); + response.setHeader("Content-Type", "text/plain", false); + response.write(value); + } +} diff --git a/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html b/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html new file mode 100644 index 0000000000..96fa2891a7 --- /dev/null +++ b/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html @@ -0,0 +1,121 @@ + + + +
+ + ++ + diff --git a/xpcom/base/ErrorList.h b/xpcom/base/ErrorList.h index 5a859c2f84..0b631842ce 100644 --- a/xpcom/base/ErrorList.h +++ b/xpcom/base/ErrorList.h @@ -225,6 +225,8 @@ ERROR(NS_ERROR_PROXY_CONNECTION_REFUSED, FAILURE(72)), /* A transfer was only partially done when it completed. */ ERROR(NS_ERROR_NET_PARTIAL_TRANSFER, FAILURE(76)), + /* HTTP/2 detected invalid TLS configuration */ + ERROR(NS_ERROR_NET_INADEQUATE_SECURITY, FAILURE(82)), /* XXX really need to better rationalize these error codes. are consumers of * necko really expected to know how to discern the meaning of these?? */