Closed Bug 1600061 Opened 6 years ago Closed 6 years ago

X-Content-Type-Options: nosniff doesn't work for documents

Categories

(Core :: DOM: Security, defect)

Product:
Core
Component:
DOM: Security
Version:
70 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1594766

People

(Reporter: info, Unassigned)

Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:70.0) Gecko/20100101 Firefox/70.0

Steps to reproduce:

if you open a file with the payload xss after an action such as a download for example, the payload triggers despite the X-Content-Type-Options header: nosniff

Actual results:

the payload triggers despite the X-Content-Type-Options: nosniff header

Expected results:

like in other browsers or as in firefox developer 71.0 should not trigger the payload

Can you provide a testcase and more detailed steps?

Group: firefox-core-security → dom-core-security
Component: Untriaged → DOM: Security
Flags: needinfo?(info)
Product: Firefox → Core
Summary: X-Content-Type-Options: nosniff doesn't work → X-Content-Type-Options: nosniff doesn't work once a "payload" has been saved locally

Hi GiJs,
I try to explain better.
If you insert an HTML file containing an XSS payload on a website, when accessing to the file via for example a download, Firefox renders the file and triggers the XSS instead of showing the code or starting the download

In the HEADER the setting are
Header set X-XSS-Protection "1; mode = block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header set X-Download-Options noopen

u can try to duplicate this state ?

If u need major info i try to do in this weekend

Flags: needinfo?(info)

Based on comment #2, I think this is a dupe of bug 1428473. Sebastian, can you confirm?

Flags: needinfo?(sstreich)
Summary: X-Content-Type-Options: nosniff doesn't work once a "payload" has been saved locally → X-Content-Type-Options: nosniff doesn't work for documents

Hey, we currently have one case where even if nosniff is set sniffing will happen.
As this is at least for now intentional,
so i'm marking this as duplicate of 1594766 :)

Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Flags: needinfo?(sstreich)
Resolution: --- → DUPLICATE
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.