1238007 - XHR should probably fail non-http URLs opened with non-GET methods

Status: RESOLVED DUPLICATE of bug 1063526

(Core :: DOM: Core & HTML, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

+++ This bug was initially created as a clone of Bug #1205288 +++

Per the current spec XHR should not allow blob URLs using the non-GET methods.  Dimi tested this in bug 1205288 comment 4 and found XHR does allow this.

We should consider blocking this to be conformant, although its also possible this was a recent spec change when XHR was changed over from

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I'm not sure what the exact proposal is here, but I'd hate to see a spot-check added for specifically the POST+blob: combination. Explicitly outlawing that but permitting other combinations doesn't seem to benefit anyone.

What I could see is generally forbidding any non-GET methods to protocols that don't setting a method. I.e. to protocols that don't support nsIHttpChannel.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

(In reply to Jonas Sicking (:sicking) from comment #1)
> What I could see is generally forbidding any non-GET methods to protocols
> that don't setting a method. I.e. to protocols that don't support
> nsIHttpChannel.

That is roughly what the fetch spec does.  It says to fail non-GET method for blob: and data: which are the only non-http protocols understood by the spec.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Cool, sounds good. The only other thing is that this could break existing webpages. It'd definitely be safer if we got some telemetry before we changed behavior.