11 files changed, 576 insertions, 0 deletions
diff --git a/dom/security/test/general/bug1277803.html b/dom/security/test/general/bug1277803.html
new file mode 100644
index 000000000..c8033551a
--- /dev/null
+++ b/dom/security/test/general/bug1277803.html
@@ -0,0 +1,11 @@
+<html>
+
+<head>
+  <link rel='icon' href='favicon_bug1277803.ico'>
+</head>
+
+<body>
+Nothing to see here...
+</body>
+
+</html>
diff --git a/dom/security/test/general/chrome.ini b/dom/security/test/general/chrome.ini
new file mode 100644
index 000000000..94bf1ef05
--- /dev/null
+++ b/dom/security/test/general/chrome.ini
@@ -0,0 +1,7 @@
+[DEFAULT]
+support-files =
+    favicon_bug1277803.ico
+    bug1277803.html
+
+[test_bug1277803.xul]
+skip-if = os == 'android'
diff --git a/dom/security/test/general/favicon_bug1277803.ico b/dom/security/test/general/favicon_bug1277803.ico
new file mode 100644
index 000000000..d44438903
--- /dev/null
+++ b/dom/security/test/general/favicon_bug1277803.ico
diff --git a/dom/security/test/general/file_block_script_wrong_mime_server.sjs b/dom/security/test/general/file_block_script_wrong_mime_server.sjs
new file mode 100644
index 000000000..d6d27796c
--- /dev/null
+++ b/dom/security/test/general/file_block_script_wrong_mime_server.sjs
@@ -0,0 +1,34 @@
+// Custom *.sjs specifically for the needs of:
+// Bug 1288361 - Block scripts with wrong MIME type
+
+"use strict";
+Components.utils.importGlobalProperties(["URLSearchParams"]);
+
+const WORKER = `
+  onmessage = function(event) {
+    postMessage("worker-loaded");
+  };`;
+
+function handleRequest(request, response) {
+  const query = new URLSearchParams(request.queryString);
+
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  // Set MIME type
+  response.setHeader("Content-Type", query.get("mime"), false);
+
+  // Deliver response
+  switch (query.get("type")) {
+    case "script":
+      response.write("");
+      break;
+    case "worker":
+      response.write(WORKER);
+      break;
+    case "worker-import":
+      response.write(`importScripts("file_block_script_wrong_mime_server.sjs?type=script&mime=${query.get("mime")}");`);
+      response.write(WORKER);
+      break;
+  }
+}
diff --git a/dom/security/test/general/file_contentpolicytype_targeted_link_iframe.sjs b/dom/security/test/general/file_contentpolicytype_targeted_link_iframe.sjs
new file mode 100644
index 000000000..f0084410a
--- /dev/null
+++ b/dom/security/test/general/file_contentpolicytype_targeted_link_iframe.sjs
@@ -0,0 +1,46 @@
+// custom *.sjs for Bug 1255240
+
+const TEST_FRAME = `
+  <!DOCTYPE HTML>
+  <html>
+  <head><meta charset='utf-8'></head>
+  <body>
+  <a id='testlink' target='innerframe' href='file_contentpolicytype_targeted_link_iframe.sjs?innerframe'>click me</a>
+  <iframe name='innerframe'></iframe>
+  <script type='text/javascript'>
+    var link = document.getElementById('testlink');
+    testlink.click();
+  </script>
+  </body>
+  </html> `;
+
+const INNER_FRAME = `
+  <!DOCTYPE HTML>
+  <html>
+  <head><meta charset='utf-8'></head>
+  hello world!
+  </body>
+  </html>`;
+
+function handleRequest(request, response)
+{
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+  response.setHeader("Content-Type", "text/html", false);
+
+  var queryString = request.queryString;
+
+  if (queryString === "testframe") {
+    response.write(TEST_FRAME);
+    return;
+  }
+
+  if (queryString === "innerframe") {
+    response.write(INNER_FRAME);
+    return;
+  }
+
+  // we should never get here, but just in case
+  // return something unexpected
+  response.write("do'h");
+}
diff --git a/dom/security/test/general/file_nosniff_testserver.sjs b/dom/security/test/general/file_nosniff_testserver.sjs
new file mode 100644
index 000000000..0cf168a3c
--- /dev/null
+++ b/dom/security/test/general/file_nosniff_testserver.sjs
@@ -0,0 +1,60 @@
+"use strict";
+Components.utils.importGlobalProperties(["URLSearchParams"]);
+
+const SCRIPT = "var foo = 24;";
+const CSS = "body { background-color: green; }";
+
+// small red image
+const IMG = atob(
+  "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
+  "P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
+
+function handleRequest(request, response) {
+  const query = new URLSearchParams(request.queryString);
+
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  // set the nosniff header
+  response.setHeader("X-Content-Type-Options", "  NoSniFF  , foo  ", false);
+
+  if (query.has("cssCorrectType")) {
+    response.setHeader("Content-Type", "teXt/cSs", false);
+    response.write(CSS);
+    return;
+  }
+
+  if (query.has("cssWrongType")) {
+    response.setHeader("Content-Type", "text/html", false);
+    response.write(CSS);
+    return;
+  }
+
+  if (query.has("scriptCorrectType")) {
+    response.setHeader("Content-Type", "appLIcation/jAvaScriPt;blah", false);
+    response.write(SCRIPT);
+    return;
+  }
+
+  if (query.has("scriptWrongType")) {
+    response.setHeader("Content-Type", "text/html", false);
+    response.write(SCRIPT);
+    return;
+  }
+
+  if (query.has("imgCorrectType")) {
+    response.setHeader("Content-Type", "iMaGe/pnG;blah", false);
+    response.write(IMG);
+    return;
+  }
+
+  if (query.has("imgWrongType")) {
+    response.setHeader("Content-Type", "text/html", false);
+    response.write(IMG);
+    return;
+  }
+
+  // we should never get here, but just in case
+  response.setHeader("Content-Type", "text/html", false);
+  response.write("do'h");
+}
diff --git a/dom/security/test/general/mochitest.ini b/dom/security/test/general/mochitest.ini
new file mode 100644
index 000000000..70c0c9fb6
--- /dev/null
+++ b/dom/security/test/general/mochitest.ini
@@ -0,0 +1,9 @@
+[DEFAULT]
+support-files =
+  file_contentpolicytype_targeted_link_iframe.sjs
+  file_nosniff_testserver.sjs
+  file_block_script_wrong_mime_server.sjs
+
+[test_contentpolicytype_targeted_link_iframe.html]
+[test_nosniff.html]
+[test_block_script_wrong_mime.html]
diff --git a/dom/security/test/general/test_block_script_wrong_mime.html b/dom/security/test/general/test_block_script_wrong_mime.html
new file mode 100644
index 000000000..f4da9c577
--- /dev/null
+++ b/dom/security/test/general/test_block_script_wrong_mime.html
@@ -0,0 +1,100 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1288361 - Block scripts with incorrect MIME type</title>
+  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<script class="testbody" type="text/javascript">
+
+const MIMETypes = [
+  ["application/javascript", true],
+  ["text/javascript", true],
+
+  ["audio/mpeg", false],
+  ["audio/", false],
+  ["image/jpeg", false],
+  ["image/", false],
+  ["video/mpeg", false],
+  ["video/", false],
+  ["text/csv", false],
+];
+
+// <script src="">
+function testScript([mime, shouldLoad]) {
+  return new Promise((resolve, reject) => {
+    let script = document.createElement("script");
+    script.onload = () => {
+      document.body.removeChild(script);
+      ok(shouldLoad, `script with mime '${mime}' should load`);
+      resolve();
+    };
+    script.onerror = () => {
+      document.body.removeChild(script);
+      ok(!shouldLoad, `script with wrong mime '${mime}' should be blocked`);
+      resolve();
+    };
+    script.src = "file_block_script_wrong_mime_server.sjs?type=script&mime="+mime;
+    document.body.appendChild(script);
+  });
+}
+
+// new Worker()
+function testWorker([mime, shouldLoad]) {
+  return new Promise((resolve, reject) => {
+    let worker = new Worker("file_block_script_wrong_mime_server.sjs?type=worker&mime="+mime);
+    worker.onmessage = (event) => {
+      ok(shouldLoad, `worker with mime '${mime}' should load`)
+      is(event.data, "worker-loaded", "worker should send correct message");
+      resolve();
+    };
+    worker.onerror = (error) => {
+      ok(!shouldLoad, `worker with wrong mime '${mime}' should be blocked`);
+      let msg = error.message;
+      ok(msg.match(/^NetworkError/) || msg.match(/Failed to load worker script/),
+         "should gets correct error message");
+      error.preventDefault();
+      resolve();
+    }
+    worker.postMessage("dummy");
+  });
+}
+
+// new Worker() with importScripts()
+function testWorkerImportScripts([mime, shouldLoad]) {
+  return new Promise((resolve, reject) => {
+    let worker = new Worker("file_block_script_wrong_mime_server.sjs?type=worker-import&mime="+mime);
+    worker.onmessage = (event) => {
+      ok(shouldLoad, `worker/importScripts with mime '${mime}' should load`)
+      is(event.data, "worker-loaded", "worker should send correct message");
+      resolve();
+    };
+    worker.onerror = (error) => {
+      ok(!shouldLoad, `worker/importScripts with wrong mime '${mime}' should be blocked`);
+      let msg = error.message;
+      ok(msg.match(/^NetworkError/) || msg.match(/Failed to load worker script/),
+         "should gets correct error message");
+      error.preventDefault();
+      resolve();
+    }
+    worker.postMessage("dummy");
+  });
+}
+
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({set: [["security.block_script_with_wrong_mime", true]]}, function() {
+  Promise.all(MIMETypes.map(testScript)).then(() => {
+    return Promise.all(MIMETypes.map(testWorker));
+  }).then(() => {
+    return Promise.all(MIMETypes.map(testWorkerImportScripts));
+  }).then(() => {
+    SpecialPowers.popPrefEnv(SimpleTest.finish);
+  });
+});
+
+</script>
+</body>
+</html>
diff --git a/dom/security/test/general/test_bug1277803.xul b/dom/security/test/general/test_bug1277803.xul
new file mode 100644
index 000000000..a62285f8a
--- /dev/null
+++ b/dom/security/test/general/test_bug1277803.xul
@@ -0,0 +1,99 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Bug 1277803 test"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        width="600"
+        height="600"
+        onload="runTest();">
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  </body>
+
+  <script type="application/javascript"><![CDATA[
+    SimpleTest.requestCompleteLog();
+    let Ci = Components.interfaces;
+    let Cc = Components.classes;
+    let Cu = Components.utils;
+    let makeURI = Cu.import("resource://gre/modules/BrowserUtils.jsm", {}).BrowserUtils.makeURI;
+
+    const BASE_URI = "http://mochi.test:8888/chrome/dom/security/test/general/";
+    const FAVICON_URI = BASE_URI + "favicon_bug1277803.ico";
+    const LOADING_URI = BASE_URI + "bug1277803.html";
+    let testWindow; //will be used to trigger favicon load
+
+    let securityManager = Cc["@mozilla.org/scriptsecuritymanager;1"].
+                          getService(Ci.nsIScriptSecurityManager);
+    let expectedPrincipal = securityManager.createCodebasePrincipal(makeURI(LOADING_URI), {});
+    let systemPrincipal = Cc["@mozilla.org/systemprincipal;1"].createInstance();
+
+    // We expect 2 favicon loads, one from PlacesUIUtils.loadFavicon and one
+    // from XUL:image loads.
+    let requestXUL = false;
+    let requestPlaces = false;
+
+    function runTest() {
+      // Register our observer to intercept favicon requests.
+      let os = Cc["@mozilla.org/observer-service;1"].
+               getService(Ci.nsIObserverService);
+      let observer = {
+        observe: function(aSubject, aTopic, aData)
+        {
+          // Make sure this is a favicon request.
+          let httpChannel = aSubject.QueryInterface(Ci.nsIHttpChannel);
+          if (FAVICON_URI != httpChannel.URI.spec) {
+            return;
+          }
+
+          // Ensure the topic is the one we set an observer for.
+          is(aTopic, "http-on-modify-request", "Expected observer topic");
+
+          // Check for the correct loadingPrincipal, triggeringPrincipal.
+          let triggeringPrincipal = httpChannel.loadInfo.triggeringPrincipal;
+          let loadingPrincipal = httpChannel.loadInfo.loadingPrincipal;
+
+          if (loadingPrincipal.equals(systemPrincipal)) {
+            // This is the favicon loading from XUL, which will have the system
+            // principal as its loading principal and have a content principal
+            // as its triggering principal.
+            ok(triggeringPrincipal.equals(expectedPrincipal),
+              "Correct triggeringPrincipal for favicon from XUL.");
+            requestXUL = true;
+          } else if (loadingPrincipal.equals(expectedPrincipal)) {
+            // This is the favicon loading from Places, which will have a
+            // content principal as its loading principal and triggering
+            // principal.
+            ok(triggeringPrincipal.equals(expectedPrincipal),
+              "Correct triggeringPrincipal for favicon from Places.");
+            requestPlaces = true;
+          } else {
+            ok(false, "An unexpected favicon request.")
+          }
+
+          // Cleanup after ourselves...
+          if (requestXUL && requestPlaces) {
+            os.removeObserver(this, "http-on-modify-request");
+            SimpleTest.finish();
+          }
+        }
+      }
+      os.addObserver(observer, "http-on-modify-request", false);
+
+      // Now that the observer is set up, trigger a favicon load with navigation
+      testWindow = window.open(LOADING_URI);
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    SimpleTest.registerCleanupFunction(function() {
+      if (testWindow) {
+        testWindow.close();
+      }
+    });
+  ]]></script>
+
+  <browser type="content-primary" flex="1" id="content" src="about:blank"/>
+</window>
diff --git a/dom/security/test/general/test_contentpolicytype_targeted_link_iframe.html b/dom/security/test/general/test_contentpolicytype_targeted_link_iframe.html
new file mode 100644
index 000000000..7b1ab72dc
--- /dev/null
+++ b/dom/security/test/general/test_contentpolicytype_targeted_link_iframe.html
@@ -0,0 +1,92 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Bug 1255240 - Test content policy types within content policies for targeted links in iframes</title>
+  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<iframe style="width:100%;" id="testframe"></iframe>
+
+<script class="testbody" type="text/javascript">
+
+/* Description of the test:
+ * Let's load a link into a targeted iframe and make sure the content policy
+ * type used for content policy checks is of TYPE_SUBDOCUMENT.
+ */
+
+const Cc = SpecialPowers.Cc;
+const Ci = SpecialPowers.Ci;
+
+const EXPECTED_CONTENT_TYPE = Ci.nsIContentPolicy.TYPE_SUBDOCUMENT;
+const EXPECTED_URL = 
+  "http://mochi.test:8888/tests/dom/security/test/general/file_contentpolicytype_targeted_link_iframe.sjs?innerframe";
+const TEST_FRAME_URL =
+  "file_contentpolicytype_targeted_link_iframe.sjs?testframe";
+
+// -----  START Content Policy implementation for the test
+var categoryManager = Cc["@mozilla.org/categorymanager;1"].getService(Ci.nsICategoryManager);
+
+const POLICYNAME = "@mozilla.org/iframetestpolicy;1";
+const POLICYID = SpecialPowers.wrap(SpecialPowers.Components)
+                              .ID("{6cc95ef3-40e1-4d59-87f0-86f100373227}");
+
+var policy = {
+  // nsISupports implementation
+  QueryInterface: function(iid) {
+    iid = SpecialPowers.wrap(iid);
+    if (iid.equals(Ci.nsISupports) ||
+        iid.equals(Ci.nsIFactory) ||
+        iid.equals(Ci.nsIContentPolicy))
+      return this;
+
+    throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
+  },
+
+  // nsIFactory implementation
+  createInstance: function(outer, iid) {
+    return this.QueryInterface(iid);
+  },
+
+  // nsIContentPolicy implementation
+  shouldLoad: function(contentType, contentLocation, requestOrigin,
+                       context, mimeTypeGuess, extra) {
+
+    // make sure we get the right amount of content policy calls
+    // e.g. about:blank also gets chrcked by content policies
+    if (contentLocation.asciiSpec === EXPECTED_URL) {
+      is(contentType, EXPECTED_CONTENT_TYPE,
+         "content policy type should TYPESUBDOCUMENT");
+      categoryManager.deleteCategoryEntry("content-policy", POLICYNAME, false);
+      SimpleTest.finish();
+    }
+    return Ci.nsIContentPolicy.ACCEPT;
+  },
+
+  shouldProcess: function(contentType, contentLocation, requestOrigin,
+                          context, mimeTypeGuess, extra) {
+    return Ci.nsIContentPolicy.ACCEPT;
+  }
+}
+policy = SpecialPowers.wrapCallbackObject(policy);
+
+// Register content policy
+var componentManager = SpecialPowers.wrap(SpecialPowers.Components).manager
+                                    .QueryInterface(Ci.nsIComponentRegistrar);
+
+componentManager.registerFactory(POLICYID, "Test content policy", POLICYNAME, policy);
+categoryManager.addCategoryEntry("content-policy", POLICYNAME, POLICYNAME, false, true);
+
+// ----- END Content Policy implementation for the test
+
+
+// start the test
+SimpleTest.waitForExplicitFinish();
+var testframe = document.getElementById("testframe");
+testframe.src = TEST_FRAME_URL;
+
+</script>
+</body>
+</html>
diff --git a/dom/security/test/general/test_nosniff.html b/dom/security/test/general/test_nosniff.html
new file mode 100644
index 000000000..197251e68
--- /dev/null
+++ b/dom/security/test/general/test_nosniff.html
@@ -0,0 +1,118 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 471020 - Add X-Content-Type-Options: nosniff support to Firefox</title>
+  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+
+  <!-- add the two css tests -->
+  <link rel="stylesheet" id="cssCorrectType">
+  <link rel="stylesheet" id="cssWrongType">
+</head>
+<body>
+
+<!-- add the two script tests -->
+<script id="scriptCorrectType"></script>
+<script id="scriptWrongType"></script>
+
+<!-- add the two img tests -->
+<img id="imgCorrectType" />
+<img id="imgWrongType" />
+
+<script class="testbody" type="text/javascript">
+/* Description of the test:
+ * We load 2 css files, 2 script files and 2 image files, where
+ * the sever either responds with the right mime type or
+ * the wrong mime type for each test.
+ */
+
+SimpleTest.waitForExplicitFinish();
+const NUM_TESTS = 6;
+
+var testCounter = 0;
+function checkFinish() {
+	testCounter++;
+	if (testCounter === NUM_TESTS) {
+		SimpleTest.finish();
+	}
+}
+
+SpecialPowers.pushPrefEnv({set: [["security.xcto_nosniff_block_images", true]]}, function() {
+
+  // 1) Test CSS with correct mime type
+  var cssCorrectType = document.getElementById("cssCorrectType");
+  cssCorrectType.onload = function() {
+    ok(true, "style nosniff correct type should load");
+    checkFinish();
+  }
+  cssCorrectType.onerror = function() {
+    ok(false, "style nosniff correct type should load");
+    checkFinish();
+  }
+  cssCorrectType.href = "file_nosniff_testserver.sjs?cssCorrectType";
+
+  // 2) Test CSS with wrong mime type
+  var cssWrongType = document.getElementById("cssWrongType");
+  cssWrongType.onload = function() {
+    ok(false, "style nosniff wrong type should not load");
+    checkFinish();
+  }
+  cssWrongType.onerror = function() {
+    ok(true, "style nosniff wrong type should not load");
+    checkFinish();
+  }
+  cssWrongType.href = "file_nosniff_testserver.sjs?cssWrongType";
+
+  // 3) Test SCRIPT with correct mime type
+  var scriptCorrectType = document.getElementById("scriptCorrectType");
+  scriptCorrectType.onload = function() {
+    ok(true, "script nosniff correct type should load");
+    checkFinish();
+  }
+  scriptCorrectType.onerror = function() {
+    ok(false, "script nosniff correct type should load");
+    checkFinish();
+  }
+  scriptCorrectType.src = "file_nosniff_testserver.sjs?scriptCorrectType";
+
+  // 4) Test SCRIPT with wrong mime type
+  var scriptWrongType = document.getElementById("scriptWrongType");
+  scriptWrongType.onload = function() {
+    ok(false, "script nosniff wrong type should not load");
+    checkFinish();
+  }
+  scriptWrongType.onerror = function() {
+    ok(true, "script nosniff wrong type should not load");
+    checkFinish();
+  }
+  scriptWrongType.src = "file_nosniff_testserver.sjs?scriptWrongType";
+
+  // 5) Test IMG with correct mime type
+  var imgCorrectType = document.getElementById("imgCorrectType");
+  imgCorrectType.onload = function() {
+    ok(true, "img nosniff correct type should load");
+    checkFinish();
+  }
+  imgCorrectType.onerror = function() {
+    ok(false, "img nosniff correct type should load");
+    checkFinish();
+  }
+  imgCorrectType.src = "file_nosniff_testserver.sjs?imgCorrectType";
+
+  // 6) Test IMG with wrong mime type
+  var imgWrongType = document.getElementById("imgWrongType");
+  imgWrongType.onload = function() {
+    ok(false, "img nosniff wrong type should not load");
+    checkFinish();
+  }
+  imgWrongType.onerror = function() {
+    ok(true, "img nosniff wrong type should not load");
+    checkFinish();
+  }
+  imgWrongType.src = "file_nosniff_testserver.sjs?imgWrongType";
+});
+
+</script>
+</body>
+</html>