Bug 1373780 - Part 3: add isImgSet argument. r=jdm

Per mixed-content-blocked spec, [1], <img srcset> and <picture> should
be blocked. However we still fetch <img srcset> and <picture> in image
preload, because they are fetched with contentPolicyType
TYPE_INTERNAL_IMAGE_PRELOAD and won't be rejected by nsMixedContentBlocker.cpp.

So I updated the image preloading code, and use the type TYPE_IMAGESET
if the image request is for <picture> or <img srcset>, otherwise for
normal image load we still use TYPE_INTERNAL_IMAGE_PRELOAD.

[1]: https://w3c.github.io/webappsec-mixed-content/#should-block-fetch
  4. Return allowed if one or more of the following conditions are met:
     request’s type is "image", and initiator is not "imageset".
  5. Return blocked.
This commit is contained in:
Yoshi Huang
2017-08-21 18:24:40 +08:00
parent 49ea89631a
commit 24a09e3edd
5 changed files with 32 additions and 15 deletions

View File

@@ -995,8 +995,9 @@ nsHtml5TreeOpExecutor::PreloadImage(const nsAString& aURL,
const nsAString& aImageReferrerPolicy)
{
nsCOMPtr<nsIURI> baseURI = BaseURIForPreload();
bool isImgSet = false;
nsCOMPtr<nsIURI> uri = mDocument->ResolvePreloadImage(baseURI, aURL, aSrcset,
aSizes);
aSizes, &isImgSet);
if (uri && ShouldPreloadURI(uri)) {
// use document wide referrer policy
mozilla::net::ReferrerPolicy referrerPolicy = mSpeculationReferrerPolicy;
@@ -1006,7 +1007,7 @@ nsHtml5TreeOpExecutor::PreloadImage(const nsAString& aURL,
referrerPolicy = imageReferrerPolicy;
}
mDocument->MaybePreLoadImage(uri, aCrossOrigin, referrerPolicy);
mDocument->MaybePreLoadImage(uri, aCrossOrigin, referrerPolicy, isImgSet);
}
}