Issue #2258 - Part 1: Support XCTO:nosniff when navigating.

ipc/glue/BackgroundUtils.cpp

@@ -295,6 +295,7 @@ LoadInfoToLoadInfoArgs(nsILoadInfo *aLoadInfo,
       aLoadInfo->GetForcePreflight(),
       aLoadInfo->GetIsPreflight(),
       aLoadInfo->GetLoadTriggeredFromExternal(),
+      aLoadInfo->GetSkipContentSniffing(),
       aLoadInfo->GetIsFromProcessingFrameAttributes()
       );
 
@@ -372,7 +373,8 @@ LoadInfoArgsToLoadInfo(const OptionalLoadInfoArgs& aOptionalLoadInfoArgs,
                           loadInfoArgs.corsUnsafeHeaders(),
                           loadInfoArgs.forcePreflight(),
                           loadInfoArgs.isPreflight(),
-                          loadInfoArgs.loadTriggeredFromExternal()
+                          loadInfoArgs.loadTriggeredFromExternal(),
+                          loadInfoArgs.skipContentSniffing()
                           );
 
   if (loadInfoArgs.isFromProcessingFrameAttributes()) {

netwerk/base/LoadInfo.cpp

@@ -66,6 +66,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mForcePreflight(false)
   , mIsPreflight(false)
   , mLoadTriggeredFromExternal(false)
+  , mSkipContentSniffing(false)
   , mIsFromProcessingFrameAttributes(false)
 {
   MOZ_ASSERT(mLoadingPrincipal);
@@ -241,6 +242,7 @@ LoadInfo::LoadInfo(nsPIDOMWindowOuter* aOuterWindow,
   , mForcePreflight(false)
   , mIsPreflight(false)
   , mLoadTriggeredFromExternal(false)
+  , mSkipContentSniffing(false)
   , mIsFromProcessingFrameAttributes(false)
 {
   // Top-level loads are never third-party
@@ -305,6 +307,7 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
   , mForcePreflight(rhs.mForcePreflight)
   , mIsPreflight(rhs.mIsPreflight)
   , mLoadTriggeredFromExternal(rhs.mLoadTriggeredFromExternal)
+  , mSkipContentSniffing(rhs.mSkipContentSniffing)
   , mIsFromProcessingFrameAttributes(rhs.mIsFromProcessingFrameAttributes)
 {
 }
@@ -333,7 +336,8 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
                    const nsTArray<nsCString>& aCorsUnsafeHeaders,
                    bool aForcePreflight,
                    bool aIsPreflight,
-                   bool aLoadTriggeredFromExternal)
+                   bool aLoadTriggeredFromExternal,
+                   bool aSkipContentSniffing)
   : mLoadingPrincipal(aLoadingPrincipal)
   , mTriggeringPrincipal(aTriggeringPrincipal)
   , mPrincipalToInherit(aPrincipalToInherit)
@@ -357,6 +361,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mForcePreflight(aForcePreflight)
   , mIsPreflight(aIsPreflight)
   , mLoadTriggeredFromExternal(aLoadTriggeredFromExternal)
+  , mSkipContentSniffing(aSkipContentSniffing)
   , mIsFromProcessingFrameAttributes(false)
 {
   // Only top level TYPE_DOCUMENT loads can have a null loadingPrincipal
@@ -965,6 +970,17 @@ LoadInfo::MaybeIncreaseTainting(uint32_t aTainting)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetSkipContentSniffing(bool* aSkipContentSniffing) {
+  *aSkipContentSniffing = mSkipContentSniffing;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadInfo::SetSkipContentSniffing(bool aSkipContentSniffing) {
+  mSkipContentSniffing = aSkipContentSniffing;
+  return NS_OK;
+}
 NS_IMETHODIMP
 LoadInfo::GetIsTopLevelLoad(bool *aResult)
 {

netwerk/base/LoadInfo.h

@@ -111,7 +111,8 @@ private:
            const nsTArray<nsCString>& aUnsafeHeaders,
            bool aForcePreflight,
            bool aIsPreflight,
-           bool aLoadTriggeredFromExternal);
+           bool aLoadTriggeredFromExternal,
+           bool aSkipContentSniffing);
   LoadInfo(const LoadInfo& rhs);
 
   friend nsresult
@@ -157,6 +158,7 @@ private:
   bool                             mForcePreflight;
   bool                             mIsPreflight;
   bool                             mLoadTriggeredFromExternal;
+  bool                             mSkipContentSniffing;
 
   // Is true if this load was triggered by processing the attributes of the
   // browsing context container.

netwerk/base/nsILoadInfo.idl

@@ -367,6 +367,15 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] readonly attribute unsigned long securityMode;
 
+
+  /**
+   * This flag is used for any browsing context where we should not sniff
+   * the content type. E.g if an iframe has the XCTO nosniff header, then
+   * that flag is set to true so we skip content sniffing for that browsing
+   * context.
+   */
+  [infallible] attribute boolean skipContentSniffing;
+ 
   /**
    * True if this request is embedded in a context that can't be third-party
    * (i.e. an iframe embedded in a cross-origin parent window). If this is

netwerk/base/nsNetUtil.cpp

@@ -2129,6 +2129,16 @@ NS_SniffContent(const char *aSnifferType, nsIRequest *aRequest,
                 const uint8_t *aData, uint32_t aLength,
                 nsACString &aSniffedType)
 {
+  // In case XCTO nosniff was present, we could just skip sniffing here
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
+  if (channel) {
+    nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+    if (loadInfo->GetSkipContentSniffing()) {
+      aSniffedType.Truncate();
+      return;
+    }
+  }
+
   typedef nsCategoryCache<nsIContentSniffer> ContentSnifferCache;
   extern ContentSnifferCache* gNetSniffers;
   extern ContentSnifferCache* gDataSniffers;

netwerk/ipc/NeckoChannelParams.ipdlh

@@ -55,6 +55,7 @@ struct LoadInfoArgs
   bool                  forcePreflight;
   bool                  isPreflight;
   bool                  loadTriggeredFromExternal;
+  bool                  skipContentSniffing;
   bool                  isFromProcessingFrameAttributes;
 };
 

netwerk/protocol/http/nsHttpChannel.cpp

@@ -14,6 +14,7 @@
 #include "nsHttp.h"
 #include "nsHttpChannel.h"
 #include "nsHttpHandler.h"
+#include "nsString.h"
 #include "nsIApplicationCacheService.h"
 #include "nsIApplicationCacheContainer.h"
 #include "nsICacheStorageService.h"
@@ -1100,6 +1101,16 @@ ProcessXCTO(nsIURI* aURI, nsHttpResponseHead* aResponseHead, nsILoadInfo* aLoadI
         ReportTypeBlocking(aURI, aLoadInfo, "MimeTypeMismatch");
         return NS_ERROR_CORRUPTED_CONTENT;
     }
+    auto policyType = aLoadInfo->GetExternalContentPolicyType();
+    if (policyType == nsIContentPolicy::TYPE_DOCUMENT ||
+        policyType == nsIContentPolicy::TYPE_SUBDOCUMENT) {
+      // If the header XCTO nosniff is set for any browsing context, then
+      // we set the skipContentSniffing flag on the Loadinfo. Within
+      // NS_SniffContent we then bail early and do not do any sniffing.
+      aLoadInfo->SetSkipContentSniffing(true);
+      return NS_OK;
+    }
+
     return NS_OK;
 }
 

netwerk/streamconv/converters/nsUnknownDecoder.cpp

@@ -315,6 +315,12 @@ nsUnknownDecoder::GetMIMETypeFromContent(nsIRequest* aRequest,
                                          uint32_t aLength,
                                          nsACString& type)
 {
+  // Note: This is only used by sniffer, therefore we do not need to lock anything here.
+  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
+  nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+  if (loadInfo->GetSkipContentSniffing()) {
+    return NS_OK;
+  }
   mBuffer = const_cast<char*>(reinterpret_cast<const char*>(aData));
   mBufferLen = aLength;
   DetermineContentType(aRequest);
@@ -345,6 +351,11 @@ bool nsUnknownDecoder::AllowSniffing(nsIRequest* aRequest)
     return false;
   }
   
+  nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+  if (loadInfo->GetSkipContentSniffing()) {
+    return false;
+  }
+  
   bool isLocalFile = false;
   if (NS_FAILED(uri->SchemeIs("file", &isLocalFile)) || isLocalFile) {
     return false;
@@ -391,10 +402,17 @@ void nsUnknownDecoder::DetermineContentType(nsIRequest* aRequest)
   NS_ASSERTION(mContentType.IsEmpty(), "Content type is already known.");
   if (!mContentType.IsEmpty()) return;
 
+  nsCOMPtr<nsIHttpChannel> channel(do_QueryInterface(aRequest));
+  if (channel) {
+    nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+    if (loadInfo->GetSkipContentSniffing()) {
+      return;
+    }
+  }
+
   const char* testData = mBuffer;
   uint32_t testDataLen = mBufferLen;
   // Check if data are compressed.
-  nsCOMPtr<nsIHttpChannel> channel(do_QueryInterface(aRequest));
   if (channel) {
     nsresult rv = ConvertEncodedData(aRequest, mBuffer, mBufferLen);
     if (NS_SUCCEEDED(rv)) {
@@ -561,6 +579,11 @@ bool nsUnknownDecoder::SniffForXML(nsIRequest* aRequest)
 
 bool nsUnknownDecoder::SniffURI(nsIRequest* aRequest)
 {
+  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
+  nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+  if (loadInfo->GetSkipContentSniffing()) {
+    return false;
+  }
   nsCOMPtr<nsIMIMEService> mimeService(do_GetService("@mozilla.org/mime;1"));
   if (mimeService) {
     nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
@@ -592,6 +615,12 @@ bool nsUnknownDecoder::LastDitchSniff(nsIRequest* aRequest)
   // All we can do now is try to guess whether this is text/plain or
   // application/octet-stream
 
+  nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
+  nsCOMPtr<nsILoadInfo> loadInfo = channel->GetLoadInfo();
+  if (loadInfo->GetSkipContentSniffing()) {
+    return false;
+  }
+
   const char* testData;
   uint32_t testDataLen;
   if (mDecodedData.IsEmpty()) {
@@ -791,6 +820,11 @@ nsBinaryDetector::DetermineContentType(nsIRequest* aRequest)
     return;
   }
 
+  nsCOMPtr<nsILoadInfo> loadInfo = httpChannel->GetLoadInfo();
+  if (loadInfo->GetSkipContentSniffing()) {
+    return;
+  }
+
   // It's an HTTP channel.  Check for the text/plain mess
   nsAutoCString contentTypeHdr;
   httpChannel->GetResponseHeader(NS_LITERAL_CSTRING("Content-Type"),

parser/html/nsHtml5StreamParser.cpp

@@ -166,6 +166,7 @@ nsHtml5StreamParser::nsHtml5StreamParser(nsHtml5TreeOpExecutor* aExecutor,
   , mLoadFlusher(new nsHtml5LoadFlusher(aExecutor))
   , mFlushTimer(do_CreateInstance("@mozilla.org/timer;1"))
   , mMode(aMode)
+  , mSkipContentSniffing(false)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   mFlushTimer->SetTarget(mThread);
@@ -549,7 +550,7 @@ nsHtml5StreamParser::FinalizeSniffing(const uint8_t* aFromSegment, // can be nul
   }
 
   // meta scan failed.
-  if (mCharsetSource >= kCharsetFromHintPrevDoc) {
+  if (!mSkipContentSniffing && mCharsetSource >= kCharsetFromHintPrevDoc) {
     mFeedChardet = false;
     return SetupDecodingAndWriteSniffingBufferAndCurrentSegment(aFromSegment, aCount, aWriteCount);
   }
@@ -874,6 +875,13 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
     mObserver->OnStartRequest(aRequest, aContext);
   }
   mRequest = aRequest;
+  nsCOMPtr<nsIChannel> myChannel(do_QueryInterface(aRequest));
+  nsCOMPtr<nsILoadInfo> loadInfo = myChannel->GetLoadInfo();
+  mSkipContentSniffing = loadInfo->GetSkipContentSniffing();
+
+  if (mSkipContentSniffing) {
+    mFeedChardet = false;
+  }
 
   mStreamState = STREAM_BEING_READ;
 

parser/html/nsHtml5StreamParser.h

@@ -561,6 +561,11 @@ class nsHtml5StreamParser : public nsICharsetDetectionObserver {
      */
     eParserMode                   mMode;
 
+    /**
+     * Whether the parser should not sniff the content type.
+     */
+    bool                          mSkipContentSniffing;
+
     /**
      * The pref html5.flushtimer.initialdelay: Time in milliseconds between
      * the time a network buffer is seen and the timer firing when the