wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 07:07:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2024 - Part 2: Add wildcard to Access-Control-Allow-{Method|Headers}

Browse source 
For requests without credentials, add wildcard to Access-Control-Allow-Headers
and Access-Control-Allow-Method.

Resolves #2024
This commit is contained in:
Moonchild 2022-11-06 13:22:44 +00:00 • committed by roytam1
commit 0a079c2b90
1 changed files with 23 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

33
netwerk/protocol/http/nsCORSListenerProxy.cpp
View file

@ -1169,7 +1169,8 @@ nsCORSPreflightListener::AddResultToCache(nsIRequest *aRequest)
} }
uint32_t i; uint32_t i;
for (i = 0; i < entry->mMethods.Length(); ++i) { for (i = 0; i < entry->mMethods.Length(); ++i) {
if (entry->mMethods[i].token.Equals(method)) { if ((entry->mMethods[i].token.EqualsLiteral("*") && !mWithCredentials) ||
entry->mMethods[i].token.Equals(method)) {
entry->mMethods[i].expirationTime = expirationTime; entry->mMethods[i].expirationTime = expirationTime;
break; break;
} }
@ -1199,7 +1200,8 @@ nsCORSPreflightListener::AddResultToCache(nsIRequest *aRequest)
} }
uint32_t i; uint32_t i;
for (i = 0; i < entry->mHeaders.Length(); ++i) { for (i = 0; i < entry->mHeaders.Length(); ++i) {
if (entry->mHeaders[i].token.Equals(header)) { if ((entry->mHeaders[i].token.EqualsLiteral("*") && !mWithCredentials) ||
entry->mHeaders[i].token.Equals(header)) {
entry->mHeaders[i].expirationTime = expirationTime; entry->mHeaders[i].expirationTime = expirationTime;
break; break;
} }
@ -1325,7 +1327,11 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
NS_ConvertUTF8toUTF16(method).get()); NS_ConvertUTF8toUTF16(method).get());
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
} }
foundMethod |= mPreflightMethod.Equals(method); if (method.EqualsLiteral("*") && !mWithCredentials) {
foundMethod = true;
} else {
foundMethod |= mPreflightMethod.Equals(method);
}
} }
if (!foundMethod) { if (!foundMethod) {
LogBlockedRequest(aRequest, "CORSMethodNotFound", nullptr); LogBlockedRequest(aRequest, "CORSMethodNotFound", nullptr);
@ -1338,6 +1344,7 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
headerVal); headerVal);
nsTArray<nsCString> headers; nsTArray<nsCString> headers;
nsCCharSeparatedTokenizer headerTokens(headerVal, ','); nsCCharSeparatedTokenizer headerTokens(headerVal, ',');
bool allowAllHeaders = false;
while(headerTokens.hasMoreTokens()) { while(headerTokens.hasMoreTokens()) {
const nsDependentCSubstring& header = headerTokens.nextToken(); const nsDependentCSubstring& header = headerTokens.nextToken();
if (header.IsEmpty()) { if (header.IsEmpty()) {
@ -1348,14 +1355,20 @@ nsCORSPreflightListener::CheckPreflightRequestApproved(nsIRequest* aRequest)
NS_ConvertUTF8toUTF16(header).get()); NS_ConvertUTF8toUTF16(header).get());
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
} }
headers.AppendElement(header); if (header.EqualsLiteral("*") && !mWithCredentials) {
allowAllHeaders = true;
} else {
headers.AppendElement(header);
}
} }
for (uint32_t i = 0; i < mPreflightHeaders.Length(); ++i) { if (!allowAllHeaders) {
if (!headers.Contains(mPreflightHeaders[i], for (uint32_t i = 0; i < mPreflightHeaders.Length(); ++i) {
nsCaseInsensitiveCStringArrayComparator())) { if (!headers.Contains(mPreflightHeaders[i],
LogBlockedRequest(aRequest, "CORSMissingAllowHeaderFromPreflight", nsCaseInsensitiveCStringArrayComparator())) {
NS_ConvertUTF8toUTF16(mPreflightHeaders[i]).get()); LogBlockedRequest(aRequest, "CORSMissingAllowHeaderFromPreflight",
return NS_ERROR_DOM_BAD_URI; NS_ConvertUTF8toUTF16(mPreflightHeaders[i]).get());
return NS_ERROR_DOM_BAD_URI;
}
} }
} }