586891 - X-Frame-Options check fails using nested URI

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Brandon Sterne (:bsterne)]

This spun out of bug 561051.  The X-Frame-Options check needs to use NS_GetInnermostURI() to extract the innermost URI from the resource being requested.  Also, in CheckFrameOptions we return early if we can't QI |request| to nsIHttpChannel, which is always the case for the nested URIs such as the one above.  We need to get the innermost URI from that request before we run our check.

Comment 1

[Brandon Sterne (:bsterne)]

Attachment: fix

Make sure nsViewSourceChannel::GetResponseHeader forwards X-Frame-Options value.

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 466470 [details] [diff] [review]
fix

r=jst, but given that I don't work on necko code very much we should have someone who does stamp this as well. dwitte, can you have a quick look at this two-liner?

Comment 3

[[e-mail]]

Comment on attachment 466470 [details] [diff] [review]
fix

r=dwitte

Comment 4

[LegNeato]

Comment on attachment 466470 [details] [diff] [review]
fix

a=LegNeato for 1.9.2.9.

Comment 5

[Brandon Sterne (:bsterne)]

1.9.2 Merge:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/6405b19fc58f

I'm going to leave the bug open until I push the trunk patch, which also fixes bug 561051.

Comment 6

[Daniel Veditz [:dveditz]]

Assuming you'll put the trunk patch here then bug 561051 depends on this; if you're putting the patch in the other bug then the other way around. Probably doesn't matter which way, but helpful to have the bugs linked.

Comment 7

[Brandon Sterne (:bsterne)]

Merge for mozilla-central
http://hg.mozilla.org/mozilla-central/rev/c5494ee56c47