Merge remote-tracking branch 'origin/tracking' into custom

netwerk/base/LoadInfo.cpp

@@ -66,6 +66,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mForcePreflight(false)
   , mIsPreflight(false)
   , mLoadTriggeredFromExternal(false)
+  , mSkipContentSniffing(false)
   , mIsFromProcessingFrameAttributes(false)
 {
   MOZ_ASSERT(mLoadingPrincipal);
@@ -241,6 +242,7 @@ LoadInfo::LoadInfo(nsPIDOMWindowOuter* aOuterWindow,
   , mForcePreflight(false)
   , mIsPreflight(false)
   , mLoadTriggeredFromExternal(false)
+  , mSkipContentSniffing(false)
   , mIsFromProcessingFrameAttributes(false)
 {
   // Top-level loads are never third-party
@@ -305,6 +307,7 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
   , mForcePreflight(rhs.mForcePreflight)
   , mIsPreflight(rhs.mIsPreflight)
   , mLoadTriggeredFromExternal(rhs.mLoadTriggeredFromExternal)
+  , mSkipContentSniffing(rhs.mSkipContentSniffing)
   , mIsFromProcessingFrameAttributes(rhs.mIsFromProcessingFrameAttributes)
 {
 }
@@ -333,7 +336,8 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
                    const nsTArray<nsCString>& aCorsUnsafeHeaders,
                    bool aForcePreflight,
                    bool aIsPreflight,
-                   bool aLoadTriggeredFromExternal)
+                   bool aLoadTriggeredFromExternal,
+                   bool aSkipContentSniffing)
   : mLoadingPrincipal(aLoadingPrincipal)
   , mTriggeringPrincipal(aTriggeringPrincipal)
   , mPrincipalToInherit(aPrincipalToInherit)
@@ -357,6 +361,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mForcePreflight(aForcePreflight)
   , mIsPreflight(aIsPreflight)
   , mLoadTriggeredFromExternal(aLoadTriggeredFromExternal)
+  , mSkipContentSniffing(aSkipContentSniffing)
   , mIsFromProcessingFrameAttributes(false)
 {
   // Only top level TYPE_DOCUMENT loads can have a null loadingPrincipal
@@ -965,6 +970,17 @@ LoadInfo::MaybeIncreaseTainting(uint32_t aTainting)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetSkipContentSniffing(bool* aSkipContentSniffing) {
+  *aSkipContentSniffing = mSkipContentSniffing;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadInfo::SetSkipContentSniffing(bool aSkipContentSniffing) {
+  mSkipContentSniffing = aSkipContentSniffing;
+  return NS_OK;
+}
 NS_IMETHODIMP
 LoadInfo::GetIsTopLevelLoad(bool *aResult)
 {

netwerk/base/LoadInfo.h

@@ -111,7 +111,8 @@ private:
            const nsTArray<nsCString>& aUnsafeHeaders,
            bool aForcePreflight,
            bool aIsPreflight,
-           bool aLoadTriggeredFromExternal);
+           bool aLoadTriggeredFromExternal,
+           bool aSkipContentSniffing);
   LoadInfo(const LoadInfo& rhs);
 
   friend nsresult
@@ -157,6 +158,7 @@ private:
   bool                             mForcePreflight;
   bool                             mIsPreflight;
   bool                             mLoadTriggeredFromExternal;
+  bool                             mSkipContentSniffing;
 
   // Is true if this load was triggered by processing the attributes of the
   // browsing context container.

netwerk/base/nsILoadInfo.idl

@@ -367,6 +367,15 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] readonly attribute unsigned long securityMode;
 
+
+  /**
+   * This flag is used for any browsing context where we should not sniff
+   * the content type. E.g if an iframe has the XCTO nosniff header, then
+   * that flag is set to true so we skip content sniffing for that browsing
+   * context.
+   */
+  [infallible] attribute boolean skipContentSniffing;
+ 
   /**
    * True if this request is embedded in a context that can't be third-party
    * (i.e. an iframe embedded in a cross-origin parent window). If this is

netwerk/base/nsNetUtil.cpp

@@ -16,6 +16,7 @@
 #include "nsContentUtils.h"
 #include "nsHashKeys.h"
 #include "nsHttp.h"
+#include "nsMimeTypes.h"
 #include "nsIAsyncStreamCopier.h"
 #include "nsIAuthPrompt.h"
 #include "nsIAuthPrompt2.h"
@@ -2149,6 +2150,33 @@ NS_SniffContent(const char *aSnifferType, nsIRequest *aRequest,
     return;
   }
 
+  aSniffedType.Truncate();
+
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
+  if (channel) {
+    nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+    if (loadInfo->GetSkipContentSniffing()) {
+      // In case XCTO nosniff was present, we should skip sniffing here, but...
+      nsAutoCString currentContentType;
+      channel->GetContentType(currentContentType);
+      // We cannot skip sniffing if the current MIME type is a JSON file.
+      // The JSON-Viewer relies on its own sniffer to determine if it can render
+      // the page, so we need to make an exception if the Server provides a valid
+      // JSON MIME type (application/json, application/web-manifest or text/json).
+      // We also don't skip sniffing if the currently-known content type is empty,
+      // to deal with webmaster errors (nosniff is set but no content-type supplied)
+      // See Issue #2258.
+      if (!currentContentType.Equals(APPLICATION_JSON) && 
+          !currentContentType.Equals(APPLICATION_WEB_MANIFEST) &&
+          !currentContentType.Equals(TEXT_JSON) &&
+          !currentContentType.IsEmpty()) {
+        // Content type supplied and it's not a JSON type; honor XCTO:nosniff.
+        return;
+      }
+    }
+  }
+  
+  // Iterate through the sniffers...
   nsCOMArray<nsIContentSniffer> sniffers;
   cache->GetEntries(sniffers);
   for (int32_t i = 0; i < sniffers.Count(); ++i) {
@@ -2157,8 +2185,9 @@ NS_SniffContent(const char *aSnifferType, nsIRequest *aRequest,
       return;
     }
   }
+  
+  // If we get here, there's nothing more to be done, return with a truncated aSniffedType.
 
-  aSniffedType.Truncate();
 }
 
 bool