1655719 - Inappropriate use of nsContentPolicyType::TYPE_OTHER in nsContentSecurityUtils::IsDownloadAllowed()

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P2)

Description

[Frederik Braun [:freddy]]

The file in https://searchfox.org/mozilla-central/source/dom/security/nsContentSecurityUtils.cpp#1131 is using TYPE_OTHER for a check on downloads.

Comment 1

[Frederik Braun [:freddy]]

I saw you implemented this recently and the function is passed a channel and creating a new loadinfo on-the-fly for a mixed content blocking check. Wouldn't it make sense to inherit the contentpolicytype from the existing channel?

Comment 2

[Sebastian Streich [:sstreich]]

Downloads caused by a navigation mostly have type_document or type_subdocument, which always pass the mixed-content blocker. So i chose type_other because there was no better option that gets the full mcb check.

Comment 3

[Frederik Braun [:freddy]]

I think we need to change Mixed Content Blocking to not give a free pass to to the TYPE_SAVEAS_DOWNLOAD anymore and use that in our callsite instead.

Comment 4

[Sebastian Streich [:sstreich]]

Attachment: Bug 1655719 - Make Type:SaveAsDownload subject to mixedContentBlocking r=ckerschb

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/19abcf869c39
Make Type:SaveAsDownload subject to mixedContentBlocking r=ckerschb

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/19abcf869c39