wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-08 08:17:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2024 - Part 1: Add wildcard to Access-Control-Expose-Headers

Browse source 
For requests without credentials, add wildcard to Access-Control-Expose-Headers.
This commit is contained in:
Moonchild 2022-11-06 12:31:17 +00:00 • committed by roytam1
commit 211b7cf219
6 changed files with 40 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

25
dom/fetch/InternalHeaders.cpp
View file

@ -364,7 +364,7 @@ InternalHeaders::BasicHeaders(InternalHeaders* aHeaders)
// static
already_AddRefed<InternalHeaders>
InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
InternalHeaders::CORSHeaders(InternalHeaders* aHeaders, RequestCredentials aCredentialsMode)
{
RefPtr<InternalHeaders> cors = new InternalHeaders(aHeaders->mGuard);
ErrorResult result;
@ -373,6 +373,7 @@ InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
aHeaders->GetFirst(NS_LITERAL_CSTRING("Access-Control-Expose-Headers"), acExposedNames, result);
MOZ_ASSERT(!result.Failed());
bool allowAllHeaders = false;
AutoTArray<nsCString, 5> exposeNamesArray;
nsCCharSeparatedTokenizer exposeTokens(acExposedNames, ',');
while (exposeTokens.hasMoreTokens()) {
@ -388,19 +389,27 @@ InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
break;
}
if (token.EqualsLiteral("*") &&
aCredentialsMode != RequestCredentials::Include) {
allowAllHeaders = true;
}
exposeNamesArray.AppendElement(token);
}
nsCaseInsensitiveCStringArrayComparator comp;
for (uint32_t i = 0; i < aHeaders->mList.Length(); ++i) {
const Entry& entry = aHeaders->mList[i];
if (entry.mName.EqualsASCII("cache-control") ||
entry.mName.EqualsASCII("content-language") ||
entry.mName.EqualsASCII("content-type") ||
entry.mName.EqualsASCII("expires") ||
entry.mName.EqualsASCII("last-modified") ||
entry.mName.EqualsASCII("pragma") ||
exposeNamesArray.Contains(entry.mName, comp)) {
if (allowAllHeaders) {
cors->Append(entry.mName, entry.mValue, result);
MOZ_ASSERT(!result.Failed());
} else if (entry.mName.EqualsASCII("cache-control") ||
entry.mName.EqualsASCII("content-language") ||
entry.mName.EqualsASCII("content-type") ||
entry.mName.EqualsASCII("expires") ||
entry.mName.EqualsASCII("last-modified") ||
entry.mName.EqualsASCII("pragma") ||
exposeNamesArray.Contains(entry.mName, comp)) {
cors->Append(entry.mName, entry.mValue, result);
MOZ_ASSERT(!result.Failed());
}