602482 - Update XHR forbidden headers to latest spec

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[m.cova]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10

XMLHttpRequest allows dangerous request headers (such as Origin and Access-Control-Request-Method) to be set. This could be used to subvert security checks, under certain conditions.

Other browsers behavior (tested the setting of the Origin header, all on Mac OS X):
- Safari 5.0.2 disallows setting the Origin header
- Chrome 6.0.472.63 disallows setting the Origin header
Relevant WebKit's changeset: http://trac.webkit.org/changeset/41547

Spec reference:
The XMLHttpRequest level 2 specification extends the list of forbidden headers to include, among others, Origin, Access-Control-Request-Headers, Access-Control-Request-Method.

It seems sensible to extend the list of forbidden headers in content/base/src/nsXMLHttpRequest.cpp:SetRequestHeader to match the list provided by the XMLHttpRequest level 2 specification.




Reproducible: Always

Comment 1

[Nickolay_Ponomarev]

http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsXMLHttpRequest.cpp#2765
http://www.w3.org/TR/XMLHttpRequest2/#the-setrequestheader-method

Comment 2

[Boris Zbarsky [:bzbarsky]]

Jonas, seems like we should fix this for 2.0.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Yup, we need to update this list to spec again.

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Update XHR forbidden headers to latest spec.

Comment 5

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment on attachment 490478 [details] [diff] [review]
Update XHR forbidden headers to latest spec.

I renamed the test too, because I like tests that have descriptive names.

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

We probably want to take this on stable branches too.

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/572b87ce4245

Comment 8

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment on attachment 490478 [details] [diff] [review]
Update XHR forbidden headers to latest spec.

This applies cleanly to 1.9.2.  Didn't test 1.9.1 yet because I don't have a tree handy.

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 490478 [details] [diff] [review]
Update XHR forbidden headers to latest spec.

Approved for 1.9.2.13 and 1.9.1.16, a=dveditz for release-drivers

code-freeze for these releases is in 4 days (11/18).

Comment 10

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/c185620e1dd7
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5b998a2bfcc3