wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 23:27:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Don't allow cross-origin POST redirects on 308 codes.

Browse source 
We already don't allow cross origin POST redirects on 307 redirects;
this adds extra guards to make sure we don't allow them on 308s either.
This commit is contained in:
Kyle Machulis 2019-07-20 15:27:48 +02:00 • committed by Roy Tam
commit b2512d610b
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
dom/plugins/base/nsPluginStreamListenerPeer.cpp
View file

@ -1381,7 +1381,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
return NS_ERROR_FAILURE; return NS_ERROR_FAILURE;
} }
// Don't allow cross-origin 307 POST redirects. // Don't allow cross-origin 307/308 POST redirects.
nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel)); nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel));
if (oldHttpChannel) { if (oldHttpChannel) {
uint32_t responseStatus; uint32_t responseStatus;
@ -1389,7 +1389,7 @@ nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsICh
if (NS_FAILED(rv)) { if (NS_FAILED(rv)) {
return rv; return rv;
} }
if (responseStatus == 307) { if (responseStatus == 307 || responseStatus == 308) {
nsAutoCString method; nsAutoCString method;
rv = oldHttpChannel->GetRequestMethod(method); rv = oldHttpChannel->GetRequestMethod(method);
if (NS_FAILED(rv)) { if (NS_FAILED(rv)) {