From 6477ec9b56b0e8497753735952ad6c01a42ba7a0 Mon Sep 17 00:00:00 2001 From: roytam1 Date: Tue, 14 Dec 2021 22:48:16 +0800 Subject: [PATCH] backport Bug 1502599: XHR should allow just "GET" method for blob URLs, r=smaug --- dom/xhr/XMLHttpRequestMainThread.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp index 8a1c1f0ada..a1afb90417 100644 --- a/dom/xhr/XMLHttpRequestMainThread.cpp +++ b/dom/xhr/XMLHttpRequestMainThread.cpp @@ -86,6 +86,7 @@ #include "mozilla/Preferences.h" #include "private/pprio.h" #include "XMLHttpRequestUpload.h" +#include "nsHostObjectProtocolHandler.h" using namespace mozilla::net; @@ -2880,6 +2881,11 @@ XMLHttpRequestMainThread::SendInternal(const RequestBodyBase* aBody) return NS_ERROR_DOM_NETWORK_ERR; } + // non-GET requests aren't allowed for blob. + if (IsBlobURI(mRequestURL) && !mRequestMethod.EqualsLiteral("GET")) { + return NS_ERROR_DOM_NETWORK_ERR; + } + PopulateNetworkInterfaceId(); // XXX We should probably send a warning to the JS console