[Network, DOM] Align our implementation with the current CORS/Fetch spec.

dom/base/nsContentUtils.cpp

@@ -7058,16 +7058,26 @@ nsContentUtils::HasDistributedChildren(nsIContent* aContent)
 
 // static
 bool
-nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader)
+nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader,
+                                         const nsACString& aValue)
 {
   if (IsForbiddenSystemRequestHeader(aHeader)) {
     return true;
   }
+  
+  if ((nsContentUtils::IsOverrideMethodHeader(aHeader) &&
+       nsContentUtils::ContainsForbiddenMethod(aValue))) {
+    return true;
+  }
 
-  return StringBeginsWith(aHeader, NS_LITERAL_CSTRING("proxy-"),
-                          nsCaseInsensitiveCStringComparator()) ||
-         StringBeginsWith(aHeader, NS_LITERAL_CSTRING("sec-"),
-                          nsCaseInsensitiveCStringComparator());
+  if (StringBeginsWith(aHeader, NS_LITERAL_CSTRING("proxy-"),
+                       nsCaseInsensitiveCStringComparator()) ||
+      StringBeginsWith(aHeader, NS_LITERAL_CSTRING("sec-"),
+                       nsCaseInsensitiveCStringComparator())) {
+    return true;
+  }
+  
+  return false;
 }
 
 // static
@@ -7096,6 +7106,64 @@ nsContentUtils::IsForbiddenResponseHeader(const nsACString& aHeader)
           aHeader.LowerCaseEqualsASCII("set-cookie2"));
 }
 
+// static 
+bool
+nsContentUtils::IsOverrideMethodHeader(const nsACString& headerName) {
+  return headerName.LowerCaseEqualsASCII("x-http-method-override") ||
+         headerName.LowerCaseEqualsASCII("x-http-method") ||
+         headerName.LowerCaseEqualsASCII("x-method-override");
+}
+
+// static
+bool
+nsContentUtils::ContainsForbiddenMethod(const nsACString& headerValue) {
+  bool hasInsecureMethod = false;
+  nsCCharSeparatedTokenizer tokenizer(headerValue, ',');
+
+  while (tokenizer.hasMoreTokens()) {
+    const nsDependentCSubstring& value = tokenizer.nextToken();
+
+    if (value.LowerCaseEqualsASCII("connect") ||
+        value.LowerCaseEqualsASCII("trace") ||
+        value.LowerCaseEqualsASCII("track")) {
+      hasInsecureMethod = true;
+      break;
+    }
+  }
+
+  return hasInsecureMethod;
+}
+
+// static
+bool nsContentUtils::IsCorsUnsafeRequestHeaderValue(
+    const nsACString& aHeaderValue) {
+  const char* cur = aHeaderValue.BeginReading();
+  const char* end = aHeaderValue.EndReading();
+
+  while (cur != end) {
+    // Implementation of
+    // https://fetch.spec.whatwg.org/#cors-unsafe-request-header-byte Is less
+    // than a space but not a horizontal tab
+    if ((*cur < ' ' && *cur != '\t') || *cur == '"' || *cur == '(' ||
+        *cur == ')' || *cur == ':' || *cur == '<' || *cur == '>' ||
+        *cur == '?' || *cur == '@' || *cur == '[' || *cur == '\\' ||
+        *cur == ']' || *cur == '{' || *cur == '}' ||
+        *cur == 0x7F) {  // 0x75 is DEL
+      return true;
+    }
+    cur++;
+  }
+  return false;
+}
+
+// static
+bool nsContentUtils::IsAllowedNonCorsAccept(const nsACString& aHeaderValue) {
+  if (IsCorsUnsafeRequestHeaderValue(aHeaderValue)) {
+    return false;
+  }
+  return true;
+}
+
 // static
 bool
 nsContentUtils::IsAllowedNonCorsContentType(const nsACString& aHeaderValue)
@@ -7103,6 +7171,10 @@ nsContentUtils::IsAllowedNonCorsContentType(const nsACString& aHeaderValue)
   nsAutoCString contentType;
   nsAutoCString unused;
 
+  if (IsCorsUnsafeRequestHeaderValue(aHeaderValue)) {
+    return false;
+  }
+
   nsresult rv = NS_ParseRequestContentType(aHeaderValue, contentType, unused);
   if (NS_FAILED(rv)) {
     return false;
@@ -7113,6 +7185,41 @@ nsContentUtils::IsAllowedNonCorsContentType(const nsACString& aHeaderValue)
          contentType.LowerCaseEqualsLiteral("multipart/form-data");
 }
 
+// static
+bool nsContentUtils::IsAllowedNonCorsLanguage(const nsACString& aHeaderValue) {
+  const char* cur = aHeaderValue.BeginReading();
+  const char* end = aHeaderValue.EndReading();
+
+  while (cur != end) {
+    if ((*cur >= '0' && *cur <= '9') || (*cur >= 'A' && *cur <= 'Z') ||
+        (*cur >= 'a' && *cur <= 'z') || *cur == ' ' || *cur == '*' ||
+        *cur == ',' || *cur == '-' || *cur == '.' || *cur == ';' ||
+        *cur == '=') {
+      cur++;
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+
+// static
+bool nsContentUtils::IsCORSSafelistedRequestHeader(const nsACString& aName,
+                                                   const nsACString& aValue) {
+  // See https://fetch.spec.whatwg.org/#cors-safelisted-request-header
+  if (aValue.Length() > 128) {
+    return false;
+  }
+  return (aName.LowerCaseEqualsLiteral("accept") &&
+          nsContentUtils::IsAllowedNonCorsAccept(aValue)) ||
+         (aName.LowerCaseEqualsLiteral("accept-language") &&
+          nsContentUtils::IsAllowedNonCorsLanguage(aValue)) ||
+         (aName.LowerCaseEqualsLiteral("content-language") &&
+          nsContentUtils::IsAllowedNonCorsLanguage(aValue)) ||
+         (aName.LowerCaseEqualsLiteral("content-type") &&
+          nsContentUtils::IsAllowedNonCorsContentType(aValue));
+}
+
 bool
 nsContentUtils::DOMWindowDumpEnabled()
 {