wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 14:58:37 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1975 - Implement Origin header CSRF mitigation.

Browse source 
Backported from Mozilla bug 446344.
This commit is contained in:
Job Bautista 2022-07-25 18:56:46 +08:00 • committed by roytam1
commit faa778ec9d
6 changed files with 82 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

53
netwerk/protocol/http/nsHttpChannel.cpp
View file

@ -5710,6 +5710,7 @@ nsHttpChannel::BeginConnect()
mRequestHead.SetHTTPS(isHttps);
mRequestHead.SetOrigin(scheme, host, port);
SetOriginHeader();
SetDoNotTrack();
NeckoOriginAttributes originAttributes;
@ -7997,6 +7998,58 @@ nsHttpChannel::ResumeInternal()
return NS_FAILED(rvTransaction) ? rvTransaction : rvCache;
}
// Step 10 of HTTP-network-or-cache fetch
void
nsHttpChannel::SetOriginHeader()
{
if (mRequestHead.IsGet() || mRequestHead.IsHead()) {
return;
}
nsAutoCString existingHeader;
Unused << mRequestHead.GetHeader(nsHttp::Origin, existingHeader);
if (!existingHeader.IsEmpty()) {
LOG(("nsHttpChannel::SetOriginHeader Origin header already present"));
return;
}
DebugOnly<nsresult> rv;
// Instead of consulting Preferences::GetInt() all the time we
// can cache the result to speed things up.
static int32_t sSendOriginHeader = 0;
static bool sIsInited = false;
if (!sIsInited) {
sIsInited = true;
Preferences::AddIntVarCache(&sSendOriginHeader,
"network.http.sendOriginHeader");
}
if (sSendOriginHeader == 0) {
// Origin header suppressed by user setting
return;
}
nsCOMPtr<nsIURI> referrer;
mLoadInfo->TriggeringPrincipal()->GetURI(getter_AddRefs(referrer));
nsAutoCString origin("null");
if (referrer && IsReferrerSchemeAllowed(referrer)) {
nsContentUtils::GetASCIIOrigin(referrer, origin);
}
// Restrict Origin to same-origin loads if requested by user
if (sSendOriginHeader == 1) {
nsAutoCString currentOrigin;
nsContentUtils::GetASCIIOrigin(mURI, currentOrigin);
if (!origin.EqualsIgnoreCase(currentOrigin.get())) {
// Origin header suppressed by user setting
return;
}
}
rv = mRequestHead.SetHeader(nsHttp::Origin, origin, false /* merge */);
MOZ_ASSERT(NS_SUCCEEDED(rv));
}
void
nsHttpChannel::SetDoNotTrack()
{