wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 15:17:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2024 - Part 2: Add wildcard to Access-Control-Allow-{Method|Headers}

Browse source 
For requests without credentials, add wildcard to Access-Control-Allow-Headers
and Access-Control-Allow-Method.

Resolves #2024
This commit is contained in:
Moonchild 2022-11-06 13:22:44 +00:00 • committed by roytam1
commit 0a079c2b90
1 changed files with 23 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
netwerk/protocol/http/nsCORSListenerProxy.cpp
View file

@ -1169,7 +1169,8 @@ nsCORSPreflightListener::AddResultToCache(nsIRequest *aRequest)
} }
uint32_t i; uint32_t i;
for (i = 0; i < entry->mMethods.Length(); ++i) { for (i = 0; i < entry->mMethods.Length(); ++i) {
if (entry->mMethods[i].token.Equals(method)) { if ((entry->mMethods[i].token.EqualsLiteral("*") && !mWithCredentials) ||
entry->mMethods[i].token.Equals(method)) {
entry->mMethods[i].expirationTime = expirationTime; entry->mMethods[i].expirationTime = expirationTime;
break; break;
} }
@ -1199,7 +1200,8 @@ nsCORSPreflightListener::AddResultToCache(nsIRequest *aRequest)
} }
uint32_t i; uint32_t i;
for (i = 0; i < entry->mHeaders.Length(); ++i) { for (i = 0; i < entry->mHeaders.Length(); ++i) {
if (entry->mHeaders[i].token.Equals(header)) { if ((entry->mHeaders[i].token.EqualsLiteral("*") && !mWithCredentials) ||
entry->mHeaders[i].token.Equals(header)) {
entry->mHeaders[i].expirationTime = expirationTime; entry->mHeaders[i].expirationTime = expirationTime;
break; break;
} }
@ -1325,8 +1327,12 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
NS_ConvertUTF8toUTF16(method).get()); NS_ConvertUTF8toUTF16(method).get());
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
} }
if (method.EqualsLiteral("*") && !mWithCredentials) {
foundMethod = true;
} else {
foundMethod |= mPreflightMethod.Equals(method); foundMethod |= mPreflightMethod.Equals(method);
} }
}
if (!foundMethod) { if (!foundMethod) {
LogBlockedRequest(aRequest, "CORSMethodNotFound", nullptr); LogBlockedRequest(aRequest, "CORSMethodNotFound", nullptr);
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
@ -1338,6 +1344,7 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
headerVal); headerVal);
nsTArray<nsCString> headers; nsTArray<nsCString> headers;
nsCCharSeparatedTokenizer headerTokens(headerVal, ','); nsCCharSeparatedTokenizer headerTokens(headerVal, ',');
bool allowAllHeaders = false;
while(headerTokens.hasMoreTokens()) { while(headerTokens.hasMoreTokens()) {
const nsDependentCSubstring& header = headerTokens.nextToken(); const nsDependentCSubstring& header = headerTokens.nextToken();
if (header.IsEmpty()) { if (header.IsEmpty()) {
@ -1348,8 +1355,13 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
NS_ConvertUTF8toUTF16(header).get()); NS_ConvertUTF8toUTF16(header).get());
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
} }
if (header.EqualsLiteral("*") && !mWithCredentials) {
allowAllHeaders = true;
} else {
headers.AppendElement(header); headers.AppendElement(header);
} }
}
if (!allowAllHeaders) {
for (uint32_t i = 0; i < mPreflightHeaders.Length(); ++i) { for (uint32_t i = 0; i < mPreflightHeaders.Length(); ++i) {
if (!headers.Contains(mPreflightHeaders[i], if (!headers.Contains(mPreflightHeaders[i],
nsCaseInsensitiveCStringArrayComparator())) { nsCaseInsensitiveCStringArrayComparator())) {
@ -1358,6 +1370,7 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
} }
} }
}
return NS_OK; return NS_OK;
} }