Bug 1373780 - Part 3: add isImgSet argument. r=jdm
Per mixed-content-blocked spec, [1], <img srcset> and <picture> should be blocked. However we still fetch <img srcset> and <picture> in image preload, because they are fetched with contentPolicyType TYPE_INTERNAL_IMAGE_PRELOAD and won't be rejected by nsMixedContentBlocker.cpp. So I updated the image preloading code, and use the type TYPE_IMAGESET if the image request is for <picture> or <img srcset>, otherwise for normal image load we still use TYPE_INTERNAL_IMAGE_PRELOAD. [1]: https://w3c.github.io/webappsec-mixed-content/#should-block-fetch 4. Return allowed if one or more of the following conditions are met: request’s type is "image", and initiator is not "imageset". 5. Return blocked.
This commit is contained in:
@@ -995,8 +995,9 @@ nsHtml5TreeOpExecutor::PreloadImage(const nsAString& aURL,
|
||||
const nsAString& aImageReferrerPolicy)
|
||||
{
|
||||
nsCOMPtr<nsIURI> baseURI = BaseURIForPreload();
|
||||
bool isImgSet = false;
|
||||
nsCOMPtr<nsIURI> uri = mDocument->ResolvePreloadImage(baseURI, aURL, aSrcset,
|
||||
aSizes);
|
||||
aSizes, &isImgSet);
|
||||
if (uri && ShouldPreloadURI(uri)) {
|
||||
// use document wide referrer policy
|
||||
mozilla::net::ReferrerPolicy referrerPolicy = mSpeculationReferrerPolicy;
|
||||
@@ -1006,7 +1007,7 @@ nsHtml5TreeOpExecutor::PreloadImage(const nsAString& aURL,
|
||||
referrerPolicy = imageReferrerPolicy;
|
||||
}
|
||||
|
||||
mDocument->MaybePreLoadImage(uri, aCrossOrigin, referrerPolicy);
|
||||
mDocument->MaybePreLoadImage(uri, aCrossOrigin, referrerPolicy, isImgSet);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user