corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1450853 - Use Generic Error for 3rdparty MediaElement r=ckerschb,smaug

Browse Source 
***
Add test

Differential Revision: https://phabricator.services.mozilla.com/D80080
This commit is contained in:
Sebastian Streich
2020-07-14 11:16:24 +00:00
parent 59cca30dab
commit 7d6032bb76
3 changed files with 73 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
dom/html/HTMLMediaElement.cpp
View File

@@ -2351,7 +2351,20 @@ void HTMLMediaElement::NoSupportedMediaSourceError(
if (mDecoder) { if (mDecoder) {
ShutdownDecoder(); ShutdownDecoder();
} }
bool isThirdPartyLoad = false;
nsresult rv = mSrcAttrTriggeringPrincipal->IsThirdPartyURI(mLoadingSrc,
&isThirdPartyLoad);
if (NS_SUCCEEDED(rv) && isThirdPartyLoad) {
// aErrorDetails can include sensitive details like MimeType or HTTP Status
// Code. In case we're loading a 3rd party resource we should not leak this
// and pass a Generic Error Message
mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED,
"Failed to open media"_ns);
} else {
mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails); mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails);
}
RemoveMediaTracks(); RemoveMediaTracks();
ChangeDelayLoadStatus(false); ChangeDelayLoadStatus(false);
UpdateAudioChannelPlayingState(); UpdateAudioChannelPlayingState();

1
dom/security/test/general/mochitest.ini
View File

@@ -63,3 +63,4 @@ support-files = file_xfo_error_page.sjs
[test_sec_fetch_websocket.html] [test_sec_fetch_websocket.html]
skip-if = toolkit == 'android' # no websocket support Bug 982828 skip-if = toolkit == 'android' # no websocket support Bug 982828
support-files = file_sec_fetch_websocket_wsh.py support-files = file_sec_fetch_websocket_wsh.py
[test_bug1450853.html]

58
dom/security/test/general/test_bug1450853.html Normal file
View File

@@ -0,0 +1,58 @@
<!DOCTYPE html>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=1450853
-->
<head>
<meta charset="utf-8">
<title>Test for Cross-origin resouce status leak via MediaError</title>
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<script src="/tests/SimpleTest/ChromeTask.js"></script>
<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
<audio autoplay id="audio"></audio>
<script type="application/javascript">
/** Test for Bug 1450853 **/
CONST_GENERIC_ERROR_MESSAGE = "Failed to open media";
add_task(function() {
return new Promise((resolve) => {
let audioElement = document.getElementById("audio");
audioElement.onerror = function() {
let err = this.error;
let message = err.message;
info(`Got Audio Error -> ${message}`);
ok(message.includes("404"), "Same-Origin Error Message may contain status data");
resolve();
};
audioElement.src = "/media/test.mp3";
});
});
add_task(function() {
return new Promise((resolve) => {
let audioElement = document.getElementById("audio");
audioElement.onerror = function() {
let err = this.error;
let message = err.message;
info(`Got Audio Error -> ${message}`);
is(message,CONST_GENERIC_ERROR_MESSAGE, "Cross-Origin Error Message is only Generic");
resolve();
};
audioElement.src = "https://example.com/media/test.mp3";
});
});
</script>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1450853">Mozilla Bug 1450853</a>
<iframe width="0" height="0"></iframe>
</body>
</html>