corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1495880 - update our cors/no-cors header safelisting to match the Fetch spec; r=hsivonen,ckerschb

Browse Source 
update XHR cors/no-cors header safelisting to match the Fetch spec

Differential Revision: https://phabricator.services.mozilla.com/D7771
This commit is contained in:
Thomas Wisniewski
2019-04-01 05:20:15 +00:00
parent 29db1ad763
commit 7bd9ab3a1a
12 changed files with 118 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
dom/xhr/XMLHttpRequestMainThread.cpp
View File

@@ -3931,20 +3931,9 @@ void RequestHeaders::ApplyToChannel(nsIHttpChannel* aHttpChannel) const {
}
void RequestHeaders::GetCORSUnsafeHeaders(nsTArray<nsCString>& aArray) const {
static const char* kCrossOriginSafeHeaders[] = {
"accept", "accept-language", "content-language", "content-type",
"last-event-id"};
const uint32_t kCrossOriginSafeHeadersLength =
ArrayLength(kCrossOriginSafeHeaders);
for (const RequestHeader& header : mHeaders) {
bool safe = false;
for (uint32_t i = 0; i < kCrossOriginSafeHeadersLength; ++i) {
if (header.mName.LowerCaseEqualsASCII(kCrossOriginSafeHeaders[i])) {
safe = true;
break;
}
}
if (!safe) {
if (!nsContentUtils::IsCORSSafelistedRequestHeader(header.mName,
header.mValue)) {
aArray.AppendElement(header.mName);
}
}