wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-07 00:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2402 - Optionally strictly enforce the MIME type of scripts loaded by importScripts(). https://bugzilla.mozilla.org/show_bug.cgi?id=1514680 This is default on in Firefox 67 but Moonchild requested it be set off by default.

Browse source
This commit is contained in:
Brian Smith 2024-01-07 08:29:30 -06:00 • committed by roytam1
commit 811bcbefd4
3 changed files with 34 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dom/locales/en-US/chrome/security/security.properties
View file

@ -82,6 +82,8 @@ MimeTypeMismatch=The resource from “%1$S” was blocked due to MIME type misma
XCTOHeaderValueMissing=X-Content-Type-Options header warning: value was “%1$S”; did you mean to send “nosniff”?
BlockScriptWithWrongMimeType=Script from “%1$S” was blocked because of a disallowed MIME type.
# LOCALIZATION NOTE: Do not translate "importScripts()"
BlockImportScriptsWithWrongMimeType=Loading script from “%1$S” with importScripts() was blocked because of a disallowed MIME type.
# LOCALIZATION NOTE: Do not translate "data: URI".
BlockTopLevelDataURINavigation=Navigation to toplevel data: URI not allowed (Blocked loading of: “%1$S”)

3
modules/libpref/init/all.js
View file

@ -2202,6 +2202,9 @@ pref("security.sri.enable", true);
// Block scripts with wrong MIME type such as image/ or video/.
pref("security.block_script_with_wrong_mime", true);
// Block scripts with wrong MIME type when loading via importScripts() in workers.
pref("security.block_importScripts_with_wrong_mime", false);
// Block images of wrong MIME for XCTO: nosniff.
pref("security.xcto_nosniff_block_images", false);

51
netwerk/protocol/http/nsHttpChannel.cpp
View file

@ -1160,35 +1160,42 @@ EnsureMIMEOfScript(nsIURI* aURI, nsHttpResponseHead* aResponseHead, nsILoadInfo*
if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/plain"))) {
// script load has type text/plain
return NS_OK;
}
if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/xml"))) {
} else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/xml"))) {
// script load has type text/xml
return NS_OK;
}
if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/octet-stream"))) {
} else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/octet-stream"))) {
// script load has type application/octet-stream
return NS_OK;
}
if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/xml"))) {
} else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/xml"))) {
// script load has type application/xml
return NS_OK;
}
if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/html"))) {
} else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/html"))) {
// script load has type text/html
return NS_OK;
}
if (contentType.IsEmpty()) {
} else if (contentType.IsEmpty()) {
// script load has no type
return NS_OK;
} else {
// script load has unknown type
// We restrict importScripts() in worker code to JavaScript MIME types.
if (aLoadInfo->InternalContentPolicyType() ==
nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS) {
// Instead of consulting Preferences::GetBool() all the time we
// can cache the result to speed things up.
static bool sCachedBlockImportScriptsWithWrongMime = false;
static bool sIsInited = false;
if (!sIsInited) {
sIsInited = true;
Preferences::AddBoolVarCache(
&sCachedBlockImportScriptsWithWrongMime,
"security.block_importScripts_with_wrong_mime");
}
// Do not block the load if the feature is not enabled.
if (!sCachedBlockImportScriptsWithWrongMime) {
return NS_OK;
}
ReportTypeBlocking(aURI, aLoadInfo, "BlockImportScriptsWithWrongMimeType");
return NS_ERROR_CORRUPTED_CONTENT;
}
}
// script load has unknown type
return NS_OK;
}