wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1975 - Implement Origin header CSRF mitigation.

Browse source 
Backported from Mozilla bug 446344.
This commit is contained in:
Job Bautista 2022-07-25 18:56:46 +08:00 • committed by roytam1
commit faa778ec9d
6 changed files with 82 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

36
netwerk/protocol/http/HttpBaseChannel.cpp
View file

@ -1398,22 +1398,10 @@ HttpBaseChannel::SetReferrerWithPolicy(nsIURI *referrer,
referrer = referrerGrip.get();
}
//
// block referrer if not on our white list...
//
static const char *const referrerWhiteList[] = {
"http",
"https",
"ftp",
nullptr
};
match = false;
const char *const *scheme = referrerWhiteList;
for (; *scheme && !match; ++scheme) {
rv = referrer->SchemeIs(*scheme, &match);
if (NS_FAILED(rv)) return rv;
// Enforce Referrer whitelist
if (!IsReferrerSchemeAllowed(referrer)) {
return NS_OK; // kick out....
}
if (!match) return NS_OK; // kick out....
//
// Handle secure referrals.
@ -2844,6 +2832,24 @@ HttpBaseChannel::AddCookiesToRequest()
SetRequestHeader(nsDependentCString(nsHttp::Cookie), cookie, false);
}
/* static */
bool
HttpBaseChannel::IsReferrerSchemeAllowed(nsIURI *aReferrer)
{
NS_ENSURE_TRUE(aReferrer, false);
nsAutoCString scheme;
nsresult rv = aReferrer->GetScheme(scheme);
NS_ENSURE_SUCCESS(rv, false);
if (scheme.EqualsIgnoreCase("https") ||
scheme.EqualsIgnoreCase("http") ||
scheme.EqualsIgnoreCase("ftp")) {
return true;
}
return false;
}
bool
HttpBaseChannel::ShouldRewriteRedirectToGET(uint32_t httpStatus,
nsHttpRequestHead::ParsedMethodType method)