From 811bcbefd469cc1727a60250968a7a60708192e3 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Sun, 7 Jan 2024 08:29:30 -0600
Subject: [PATCH] Issue #2402 - Optionally strictly enforce the MIME type of
 scripts loaded by importScripts().
 https://bugzilla.mozilla.org/show_bug.cgi?id=1514680 This is default on in
 Firefox 67 but Moonchild requested it be set off by default.

---
 .../en-US/chrome/security/security.properties |  2 +
 modules/libpref/init/all.js                   |  3 ++
 netwerk/protocol/http/nsHttpChannel.cpp       | 51 +++++++++++--------
 3 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/dom/locales/en-US/chrome/security/security.properties b/dom/locales/en-US/chrome/security/security.properties
index 2be56fb9d3..988b6d8f1a 100644
--- a/dom/locales/en-US/chrome/security/security.properties
+++ b/dom/locales/en-US/chrome/security/security.properties
@@ -82,6 +82,8 @@ MimeTypeMismatch=The resource from “%1$S” was blocked due to MIME type misma
 XCTOHeaderValueMissing=X-Content-Type-Options header warning: value was “%1$S”; did you mean to send “nosniff”?
 
 BlockScriptWithWrongMimeType=Script from “%1$S” was blocked because of a disallowed MIME type.
+# LOCALIZATION NOTE: Do not translate "importScripts()"
+BlockImportScriptsWithWrongMimeType=Loading script from “%1$S” with importScripts() was blocked because of a disallowed MIME type.
 
 # LOCALIZATION NOTE: Do not translate "data: URI".
 BlockTopLevelDataURINavigation=Navigation to toplevel data: URI not allowed (Blocked loading of: “%1$S”)
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 1f0ad89f71..fef4c449cd 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2202,6 +2202,9 @@ pref("security.sri.enable", true);
 // Block scripts with wrong MIME type such as image/ or video/.
 pref("security.block_script_with_wrong_mime", true);
 
+// Block scripts with wrong MIME type when loading via importScripts() in workers.
+pref("security.block_importScripts_with_wrong_mime", false);
+
 // Block images of wrong MIME for XCTO: nosniff.
 pref("security.xcto_nosniff_block_images", false);
 
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 1bf57a0d3b..ea95740870 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -1160,35 +1160,42 @@ EnsureMIMEOfScript(nsIURI* aURI, nsHttpResponseHead* aResponseHead, nsILoadInfo*
 
     if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/plain"))) {
         // script load has type text/plain
-        return NS_OK;
-    }
-
-    if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/xml"))) {
+    } else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/xml"))) {
         // script load has type text/xml
-        return NS_OK;
-    }
-
-    if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/octet-stream"))) {
+    } else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/octet-stream"))) {
         // script load has type application/octet-stream
-        return NS_OK;
-    }
-
-    if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/xml"))) {
+    } else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("application/xml"))) {
         // script load has type application/xml
-        return NS_OK;
-    }
-
-    if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/html"))) {
+    } else if (StringBeginsWith(contentType, NS_LITERAL_CSTRING("text/html"))) {
         // script load has type text/html
-        return NS_OK;
-    }
-
-    if (contentType.IsEmpty()) {
+    } else if (contentType.IsEmpty()) {
         // script load has no type
-        return NS_OK;
+    } else {
+        // script load has unknown type
+        // We restrict importScripts() in worker code to JavaScript MIME types.
+        if (aLoadInfo->InternalContentPolicyType() ==
+            nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS) {
+              // Instead of consulting Preferences::GetBool() all the time we
+              // can cache the result to speed things up.
+             static bool sCachedBlockImportScriptsWithWrongMime = false;
+             static bool sIsInited = false;
+             if (!sIsInited) {
+               sIsInited = true;
+               Preferences::AddBoolVarCache(
+                   &sCachedBlockImportScriptsWithWrongMime,
+                   "security.block_importScripts_with_wrong_mime");
+             }
+         
+            // Do not block the load if the feature is not enabled.
+            if (!sCachedBlockImportScriptsWithWrongMime) {
+               return NS_OK;
+            }
+    
+            ReportTypeBlocking(aURI, aLoadInfo, "BlockImportScriptsWithWrongMimeType");
+            return NS_ERROR_CORRUPTED_CONTENT;
+        }
     }
 
-    // script load has unknown type
     return NS_OK;
 }