1299267 - Return a network error for requests whose type is "script" with additional bad MIME types

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Tom S. (please needinfo tschuster)]

We are pretty close to landing a pull request that also blocks audio/*, video/* and text/csv.

Comment 1

[Tom S. (please needinfo tschuster)]

Attachment: Block additional wrong mime types for scripts

Comment 2

[Tom S. (please needinfo tschuster)]

Attachment: Test for wrong mime types

I really wanted to use add_task, but for some reason that wasn't available. The new test set-up makes it easy to add new mime types for testing.

Comment 3

[Tom S. (please needinfo tschuster)]

Attachment: Block additional wrong mime types for scripts

Comment 4

[Christoph Kerschbaumer [:ckerschb}]

Comment on attachment 8788152 [details] [diff] [review]
Block additional wrong mime types for scripts

Review of attachment 8788152 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks, r=me;

::: netwerk/protocol/http/nsHttpChannel.cpp
@@ +1070,4 @@
>          return NS_OK;
>      }
>  
> +    bool block = true;

Nit: I would prefer if we do |bool block = false;| and within every branch explicitly update to |block = true;| and remove the else branch, but I leave it up to you.

Comment 5

[Christoph Kerschbaumer [:ckerschb}]

Comment on attachment 8787997 [details] [diff] [review]
Test for wrong mime types

Review of attachment 8787997 [details] [diff] [review]:
-----------------------------------------------------------------

thanks, r=me

Comment 6

[Tom S. (please needinfo tschuster)]

Attachment: Add additonal telemetry types

We still have around 5% of unknown types, especially the empty case should reduce this.

Comment 7

[Christoph Kerschbaumer [:ckerschb}]

Comment on attachment 8788175 [details] [diff] [review]
Add additonal telemetry types

Review of attachment 8788175 [details] [diff] [review]:
-----------------------------------------------------------------

thanks. r=me

::: toolkit/components/telemetry/Histograms.json
@@ +5527,4 @@
>      "bug_numbers": [1288361],
>      "expires_in_version": "56",
>      "kind": "enumerated",
> +    "n_values": 15,

I am not entirely sure about the relation between n_values and the actual values. I would imagine you want n_values to be 12 though.

Comment 8

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #7)
> ::: toolkit/components/telemetry/Histograms.json
> @@ +5527,4 @@
> >      "bug_numbers": [1288361],

Actually, I think you should add 1299267 to the bug_numbers.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/eb31c2fb7a7d
Block additional wrong mime types for scripts. r=ckerschb
https://hg.mozilla.org/integration/mozilla-inbound/rev/5f81dca324d1
Test for wrong mime types. r=ckerschb
https://hg.mozilla.org/integration/mozilla-inbound/rev/9e802eac60df
Add additonal telemetry types. r=ckerschb

Comment 10

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/eb31c2fb7a7d
https://hg.mozilla.org/mozilla-central/rev/5f81dca324d1
https://hg.mozilla.org/mozilla-central/rev/9e802eac60df

Comment 11

[Tom S. (please needinfo tschuster)]

Seems like I screwed up the telemetry data :/ https://mzl.la/2bQOUXZ Somehow we get a huge amount of hits on 11/12? I only added 10/11.

Comment 12

[Kohei Yoshino [:kohei]]

Posted the site compatibility doc: https://www.fxsitecompat.com/en-CA/docs/2016/javascript-served-with-wrong-mime-type-will-be-blocked/

Comment 13

[Jean-Yves Perrier [:teoli]]

Added a comment near the top of:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/scrip
and
https://developer.mozilla.org/en-US/docs/Web/API/HTMLScriptElement

as well as a line in:
https://developer.mozilla.org/en-US/Firefox/Releases/51#Networking

Comment 14

[Jean-Yves Perrier [:teoli]]

Mmmh, I was too quick.

1. the first link is: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script

2. Also I added some info in:
https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope/importScripts
https://developer.mozilla.org/en-US/docs/Web/API/Worker/Worker#Exceptions
https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker/ServiceWorker#Exceptions