Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(171)

Side by Side Diff: third_party/WebKit/Source/core/dom/ScriptLoader.cpp

Issue 2294283002: Stop sniffing 'audio/', 'video/', and 'text/csv' into script. (Closed)
Patch Set: rebase Created 4 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) 2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
3 * (C) 1999 Antti Koivisto (koivisto@kde.org) 3 * (C) 1999 Antti Koivisto (koivisto@kde.org)
4 * (C) 2001 Dirk Mueller (mueller@kde.org) 4 * (C) 2001 Dirk Mueller (mueller@kde.org)
5 * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserv ed. 5 * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserv ed.
6 * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org> 6 * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
7 * 7 *
8 * This library is free software; you can redistribute it and/or 8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Library General Public 9 * modify it under the terms of the GNU Library General Public
10 * License as published by the Free Software Foundation; either 10 * License as published by the Free Software Foundation; either
(...skipping 370 matching lines...) Expand 10 before | Expand all | Expand 10 after
381 381
382 if (m_isExternalScript) { 382 if (m_isExternalScript) {
383 ScriptResource* resource = m_resource ? m_resource.get() : sourceCode.re source(); 383 ScriptResource* resource = m_resource ? m_resource.get() : sourceCode.re source();
384 if (resource) { 384 if (resource) {
385 if (!resource->mimeTypeAllowedByNosniff()) { 385 if (!resource->mimeTypeAllowedByNosniff()) {
386 contextDocument->addConsoleMessage(ConsoleMessage::create(Securi tyMessageSource, ErrorMessageLevel, "Refused to execute script from '" + resourc e->url().elidedString() + "' because its MIME type ('" + resource->httpContentTy pe() + "') is not executable, and strict MIME type checking is enabled.")); 386 contextDocument->addConsoleMessage(ConsoleMessage::create(Securi tyMessageSource, ErrorMessageLevel, "Refused to execute script from '" + resourc e->url().elidedString() + "' because its MIME type ('" + resource->httpContentTy pe() + "') is not executable, and strict MIME type checking is enabled."));
387 return false; 387 return false;
388 } 388 }
389 389
390 String mimetype = resource->httpContentType(); 390 String mimetype = resource->httpContentType();
391 if (mimetype.startsWith("image/")) { 391 if (mimetype.startsWith("image/") || mimetype == "text/csv" || mimet ype.startsWith("audio/") || mimetype.startsWith("video/")) {
392 contextDocument->addConsoleMessage(ConsoleMessage::create(Securi tyMessageSource, ErrorMessageLevel, "Refused to execute script from '" + resourc e->url().elidedString() + "' because its MIME type ('" + mimetype + "') is not e xecutable.")); 392 contextDocument->addConsoleMessage(ConsoleMessage::create(Securi tyMessageSource, ErrorMessageLevel, "Refused to execute script from '" + resourc e->url().elidedString() + "' because its MIME type ('" + mimetype + "') is not e xecutable."));
393 UseCounter::count(frame, UseCounter::BlockedSniffingImageToScrip t); 393 if (mimetype.startsWith("image/"))
394 UseCounter::count(frame, UseCounter::BlockedSniffingImageToS cript);
395 else if (mimetype.startsWith("audio/"))
396 UseCounter::count(frame, UseCounter::BlockedSniffingAudioToS cript);
397 else if (mimetype.startsWith("video/"))
398 UseCounter::count(frame, UseCounter::BlockedSniffingVideoToS cript);
399 else if (mimetype == "text/csv")
400 UseCounter::count(frame, UseCounter::BlockedSniffingCSVToScr ipt);
394 return false; 401 return false;
395 } 402 }
396 403
397 logScriptMimetype(resource, frame, mimetype); 404 logScriptMimetype(resource, frame, mimetype);
398 } 405 }
399 } 406 }
400 407
401 // FIXME: Can this be moved earlier in the function? 408 // FIXME: Can this be moved earlier in the function?
402 // Why are we ever attempting to execute scripts without a frame? 409 // Why are we ever attempting to execute scripts without a frame?
403 if (!frame) 410 if (!frame)
(...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after
521 if (isHTMLScriptLoader(element)) 528 if (isHTMLScriptLoader(element))
522 return toHTMLScriptElement(element)->loader(); 529 return toHTMLScriptElement(element)->loader();
523 530
524 if (isSVGScriptLoader(element)) 531 if (isSVGScriptLoader(element))
525 return toSVGScriptElement(element)->loader(); 532 return toSVGScriptElement(element)->loader();
526 533
527 return 0; 534 return 0;
528 } 535 }
529 536
530 } // namespace blink 537 } // namespace blink
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698