Issue #2402 - Require ServiceWorkerGlobalScope.importScripts() to only accept JavaScript MIME types. https://bugzilla.mozilla.org/show_bug.cgi?id=1354577 Require ServiceWorkerContainer.register() to only accept JavaScript MIME types.

This commit is contained in:
Brian Smith 2024-01-07 07:37:47 -06:00 committed by roytam1
commit b7abd4a127
3 changed files with 33 additions and 5 deletions

View file

@ -801,12 +801,11 @@ CompareNetwork::OnStreamComplete(nsIStreamLoader* aLoader, nsISupports* aContext
return rv;
}
if (!mimeType.LowerCaseEqualsLiteral("text/javascript") &&
!mimeType.LowerCaseEqualsLiteral("application/x-javascript") &&
!mimeType.LowerCaseEqualsLiteral("application/javascript")) {
if (mimeType.IsEmpty() ||
!nsContentUtils::IsJavascriptMIMEType(NS_ConvertUTF8toUTF16(mimeType))) {
RefPtr<ServiceWorkerRegistrationInfo> registration = mManager->GetRegistration();
ServiceWorkerManager::LocalizeAndReportToAllClients(
registration->mScope, "ServiceWorkerRegisterMimeTypeError",
registration->mScope, "ServiceWorkerRegisterMimeTypeError2",
nsTArray<nsString> { NS_ConvertUTF8toUTF16(registration->mScope),
NS_ConvertUTF8toUTF16(mimeType), mManager->URL() });
mManager->NetworkFinished(NS_ERROR_DOM_SECURITY_ERR);