Open Bug 2089487 Opened 4 days ago Updated 9 hours ago

ORB allows opaque text/plain responses with nosniff

Categories

(Core :: DOM: Networking, defect, P2)

Product:
Core
Component:
DOM: Networking
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox161 --- affected

People

(Reporter: zcorpan, Assigned: farre)

References

Details

(Whiteboard: [necko-triaged])

Gecko's ORB allows opaque text/plain responses with X-Content-Type-Options: nosniff. IsOpaqueSafeListedSpecBreakingMIMEType allows them before the nosniff check runs:
https://searchfox.org/firefox-main/rev/cac25a6fa321b0051932359b84c4e2fe3caabdc5/netwerk/protocol/http/OpaqueResponseUtils.cpp#63-67

Bug 1828375 added this to emulate Chromium's gradual transition, but Chromium now blocks these responses:
https://source.chromium.org/chromium/chromium/src/+/6ca4e60b94475fa916dfb688608e6cc72693a1bf:services/network/public/cpp/orb/orb_impl.cc;l=334-341

The Fetch spec PR blocks them too: https://github.com/whatwg/fetch/pull/1755

Test: "ORB should block opaque image labeled text/plain with nosniff: <img src=...>" in https://github.com/web-platform-tests/wpt/pull/64714 (fetch/orb/tentative/nosniff.sub.any.js). Fails in Firefox Nightly, passes in Chrome Canary.

Priority: -- → P2
Whiteboard: [necko-triaged]
You need to log in before you can comment on or make changes to this bug.