1583869 - NoSniff breaks JSON Viewer for content types other than application/json and application/manifest+json

Status: RESOLVED FIXED

(DevTools :: JSON Viewer, defect, P1)

Description

[Oriol Brufau [:Oriol]]

The JSON Viewer loads when the content type is application/json or any application/*+json.

However, bug 1578991 only handled application/json, application/manifest+json and text/json.

Therefore, with NoSniff, the JSON viewer doesn't load for content types like application/vnd.api+json, application/hal+json or application/ld+json.

Testcase: run this file in a server with php:

<?php
header("Content-Type: application/vnd.api+json");
header("x-content-type-options: nosniff");
echo '[1,2,3]';
?>

Expected: the JSON Viewer displays the contents.
Actual: Firefox offers to download the file.

Comment 1

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Thanks for the report!

Looks like we need to fix the following line?
https://searchfox.org/mozilla-central/rev/f43ae7e1c43a4a940b658381157a6ea6c5a185c1/devtools/client/jsonview/converter-observer.js#94

Honza

Comment 2

[Oriol Brufau [:Oriol]]

(In reply to Jan Honza Odvarko [:Honza] (always need-info? me) from comment #1)

Looks like we need to fix the following line?
https://searchfox.org/mozilla-central/rev/f43ae7e1c43a4a940b658381157a6ea6c5a185c1/devtools/client/jsonview/converter-observer.js#94

That line is fine, what should be fixed is
https://searchfox.org/mozilla-central/rev/f43ae7e1c43a4a940b658381157a6ea6c5a185c1/netwerk/base/nsNetUtil.cpp#2732-2734

Comment 3

[Jan Honza Odvarko [:Honza] (always need-info? me)]

@Oriol, thanks for clarification!
Honza

Comment 4

[Sebastian Streich [:sstreich]]

Attachment: Bug 1583869 - Call Sniffers for application/* mime Types r=ckerschb

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/04f75de35ca7
Call Sniffers for application/* mime Types r=ckerschb

Comment 6

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/04f75de35ca7

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

We don't need this in 70 now, right? I think this was just disabled in bug 1585055 (?)

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

I'll just leave this affected for now and track it till I hear back.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Changing the priority to p1 as the bug is tracked by a release manager for the current beta.
See What Do You Triage for more information

Comment 10

[Sebastian Streich [:sstreich]]

Hey! Yes once bug 1585055 is uplifted, ff70 is unaffected of this.