wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-06 15:58:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1959 - Don't apply CSPs to explicit data documents and images.

Browse source 
This resolves #1959
This commit is contained in:
Moonchild 2022-07-12 12:48:06 +00:00 • committed by roytam1
commit 8831656c85
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
dom/base/nsDocument.cpp
View file

@ -2504,6 +2504,21 @@ nsDocument::InitCSP(nsIChannel* aChannel)
return NS_OK;
}
// If this is explicitly loaded as a data document, no need to set a CSP.
if (mLoadedAsData) {
return NS_OK;
}
// If this is an image, no need to set a CSP.
// If we don't do this, SVG images will be parsed as normal XML documents and
// subject to served CSPs, which might block internally applied inline styles.
// See UXP issue #1959.
nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
if (loadInfo->GetExternalContentPolicyType() ==
nsIContentPolicy::TYPE_IMAGE) {
return NS_OK;
}
nsAutoCString tCspHeaderValue, tCspROHeaderValue;
nsCOMPtr<nsIHttpChannel> httpChannel;
@ -2532,7 +2547,6 @@ nsDocument::InitCSP(nsIChannel* aChannel)
// Check if this is a signed content to apply default CSP.
bool applySignedContentCSP = false;
nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
if (loadInfo && loadInfo->GetVerifySignedContent()) {
applySignedContentCSP = true;
}