Allow lax MIME type parsing for same-origin CSS in quirks mode.

Source/core/css/StyleSheetContents.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 263 matching lines @@
         return nullAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
     if (prefix == starAtom)
         return starAtom; // We'll match any namespace.
     return m_namespaces.get(prefix);
 }
 
 void StyleSheetContents::parseAuthorStyleSheet(const CSSStyleSheetResource* cachedStyleSheet, const SecurityOrigin* securityOrigin)
 {
     TRACE_EVENT1("blink,devtools.timeline", "ParseAuthorStyleSheet", "data", InspectorParseAuthorStyleSheetEvent::data(cachedStyleSheet));
 
-    bool hasValidMIMEType = false;
-    String sheetText = cachedStyleSheet->sheetText(&hasValidMIMEType);
+    bool isSameOriginRequest = securityOrigin && securityOrigin->canRequest(baseURL());
+    CSSStyleSheetResource::MIMETypeCheck mimeTypeCheck = isQuirksModeBehavior(m_parserContext.mode()) && isSameOriginRequest ? CSSStyleSheetResource::MIMETypeCheck::Lax : CSSStyleSheetResource::MIMETypeCheck::Strict;
+    String sheetText = cachedStyleSheet->sheetText(mimeTypeCheck);
 
     const ResourceResponse& response = cachedStyleSheet->response();
     m_sourceMapURL = response.httpHeaderField("SourceMap");
     if (m_sourceMapURL.isEmpty()) {
         // Try to get deprecated header.
         m_sourceMapURL = response.httpHeaderField("X-SourceMap");
     }
 
     CSSParserContext context(parserContext(), UseCounter::getFrom(this));
     CSSParser::parseSheet(context, this, sheetText, nullptr);
-
-    // If we're loading a stylesheet cross-origin, and the MIME type is not standard, require the CSS
-    // to at least start with a syntactically valid CSS rule.
-    // This prevents an attacker playing games by injecting CSS strings into HTML, XML, JSON, etc. etc.
-    if (!hasValidMIMEType && !hasSyntacticallyValidCSSHeader()) {
-        bool isCrossOriginCSS = !securityOrigin || !securityOrigin->canRequest(baseURL());
-        if (isCrossOriginCSS) {
-            clearRules();
-            return;
-        }
-    }
 }
 
 void StyleSheetContents::parseString(const String& sheetText)
 {
     parseStringAtPosition(sheetText, TextPosition::minimumPosition());
 }
 
 void StyleSheetContents::parseStringAtPosition(const String& sheetText, const TextPosition& startPosition)
 {
     CSSParserContext context(parserContext(), UseCounter::getFrom(this));
@@ skipping 332 matching lines @@
     visitor->trace(m_ownerRule);
     visitor->trace(m_importRules);
     visitor->trace(m_childRules);
     visitor->trace(m_loadingClients);
     visitor->trace(m_completedClients);
     visitor->trace(m_ruleSet);
 #endif
 }
 
 }