summaryrefslogtreecommitdiffstats
path: root/docshell/base
diff options
context:
space:
mode:
authorjanekptacijarabaci <janekptacijarabaci@seznam.cz>2017-08-25 09:25:03 +0200
committerwolfbeast <mcwerewolf@gmail.com>2018-02-22 11:18:23 +0100
commita06ce3f03b260d59199dba7e01ea8afb3de1ef59 (patch)
treed55ccf486d68b1dde83f56a95bb6e8121a7ba48f /docshell/base
parent62d535967977ea64884e4418d78f1dc245e682e1 (diff)
downloadUXP-a06ce3f03b260d59199dba7e01ea8afb3de1ef59.tar
UXP-a06ce3f03b260d59199dba7e01ea8afb3de1ef59.tar.gz
UXP-a06ce3f03b260d59199dba7e01ea8afb3de1ef59.tar.lz
UXP-a06ce3f03b260d59199dba7e01ea8afb3de1ef59.tar.xz
UXP-a06ce3f03b260d59199dba7e01ea8afb3de1ef59.zip
CSP: Upgrade SO navigational requests per spec.
Diffstat (limited to 'docshell/base')
-rw-r--r--docshell/base/nsDocShell.cpp23
1 files changed, 23 insertions, 0 deletions
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index ab119a016..2e08e6720 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -11025,6 +11025,29 @@ nsDocShell::DoURILoad(nsIURI* aURI,
}
}
+ // Navigational requests that are same origin need to be upgraded in case
+ // upgrade-insecure-requests is present. Please note that in that case
+ // the triggeringPrincipal is holding the CSP that potentially
+ // holds upgrade-insecure-requests.
+ nsCOMPtr<nsIContentSecurityPolicy> csp;
+ aTriggeringPrincipal->GetCsp(getter_AddRefs(csp));
+ if (csp) {
+ bool upgradeInsecureRequests = false;
+ csp->GetUpgradeInsecureRequests(&upgradeInsecureRequests);
+ if (upgradeInsecureRequests) {
+ // only upgrade if the navigation is same origin
+ nsCOMPtr<nsIPrincipal> resultPrincipal;
+ rv = nsContentUtils::GetSecurityManager()->
+ GetChannelResultPrincipal(channel,
+ getter_AddRefs(resultPrincipal));
+ NS_ENSURE_SUCCESS(rv, rv);
+ if (resultPrincipal->Equals(aTriggeringPrincipal)) {
+ static_cast<mozilla::LoadInfo*>(loadInfo.get())->SetUpgradeInsecureRequests();
+ }
+ }
+ }
+
+
nsCOMPtr<nsIApplicationCacheChannel> appCacheChannel =
do_QueryInterface(channel);
if (appCacheChannel) {