Issue #2258 - Part 3: Allow sniffing with XCTO:nosniff + empty MIME type.

This moves the checking code back to NS_SniffContent and specifically
checks requests for either:
- Empty `Content-type` header, OR
- A known JSON MIME type

If present, sniffing is allowed despite `nosniff` because in the first
case this is webmaster error (conflicting `nosniff` without MIME type
would always fail, so sniff it), and in the second case we need this
carveout or our json viewer will break.
This commit is contained in:
Moonchild 2025-08-12 19:04:34 +02:00 • committed by roytam1
commit 707c3e3fa8
5 changed files with 31 additions and 35 deletions

View file

@ -2489,13 +2489,6 @@ imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
uint32_t aLength,
nsACString& aContentType)
{
nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
if (channel) {
nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
if (loadInfo->GetSkipContentSniffing()) {
return NS_ERROR_NOT_AVAILABLE;
}
}
return GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
}