Implement script MIME restrictions for X-Content-Type-Options: nosniff for Workers

Implement script MIME restrictions for X-Content-Type-Options: nosniff for Workers

The restrictions for ScriptResources were introduced 4 years ago.
https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd4482313a078378680f
But the restrictions for worker scripts were not introduced.

BUG=689003
Review-Url: https://codereview.chromium.org/2689173002
Cr-Commit-Position: refs/heads/master@{#449937}
Committed: https://chromium.googlesource.com/chromium/src/+/483690f08302c4e870ca10e7685cc9b551bd43c7

[horo, 2017-02-13 05:51:55]

The CQ bit was checked by horo@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-13 05:52:06]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[horo, 2017-02-13 06:55:03]

Description was changed from

==========
apply nosniff to importScript

BUG=689003
==========

to

==========
Implement script MIME restrictions for X-Content-Type-Options: nosniff for
Workers

The restrictions for ScriptResources were introduced 4 years ago.
https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd448231...
But the restrictions for worker scripts were not introduced.

BUG=689003
==========

[horo, 2017-02-13 06:55:15]

The CQ bit was checked by horo@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-13 06:55:36]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[horo, 2017-02-13 06:57:45]

Patchset #3 (id:40001) has been deleted

[horo, 2017-02-13 07:00:17]

horo@chromium.org changed reviewers:
+ mkwst@chromium.org

[horo, 2017-02-13 07:00:17]

mkwst@
Could you please review this?

[Mike West, 2017-02-13 09:56:09]

LGTM if you update the tests a bit. :)

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
File
third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
(right):

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm:12:
});
This is probably cleaner to write as:

```
fetch_tests_from_worker("./support/ImportScriptsNosniffErr.js");
```

in the HTML file, and

```
test(t => {
  assert_throws(...);
}, "importScripts throws on 'nosniff' violation");
```

in the .js file.

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
File third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm
(right):

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm:9:
worker.onerror = t.step_func_done(function(e) {});
Nit: Can you verify the properties of the error event?

[horo, 2017-02-13 10:30:06]

The CQ bit was checked by horo@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-13 10:30:23]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[horo, 2017-02-13 10:30:50]

Thank you.

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
File
third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
(right):

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm:12:
});
On 2017/02/13 09:56:08, Mike West (sloooooow) wrote:
> This is probably cleaner to write as:
> 
> ```
> fetch_tests_from_worker("./support/ImportScriptsNosniffErr.js");
> ```
> 
> in the HTML file, and
> 
> ```
> test(t => {
>   assert_throws(...);
> }, "importScripts throws on 'nosniff' violation");
> ```
> 
> in the .js file.

Done.

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
File third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm
(right):

https://codereview.chromium.org/2689173002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm:9:
worker.onerror = t.step_func_done(function(e) {});
On 2017/02/13 09:56:08, Mike West (sloooooow) wrote:
> Nit: Can you verify the properties of the error event?

Done.

[commit-bot: I haz the power, 2017-02-13 12:08:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-13 12:08:19]

Dry run: This issue passed the CQ dry run.

[horo, 2017-02-13 13:03:36]

The CQ bit was checked by horo@chromium.org

[horo, 2017-02-13 13:03:36]

The patchset sent to the CQ was uploaded after l-g-t-m from mkwst@chromium.org
Link to the patchset: https://codereview.chromium.org/2689173002/#ps60001
(title: "incorporated mkwst@'s comment")

[commit-bot: I haz the power, 2017-02-13 13:03:53]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-13 13:09:18]

CQ is committing da patch.

Bot data: {"patchset_id": 60001, "attempt_start_ts": 1486991016296410,
"parent_rev": "7218269c5a015a91630aa94b1e3d696237a29d52", "commit_rev":
"483690f08302c4e870ca10e7685cc9b551bd43c7"}

[commit-bot: I haz the power, 2017-02-13 13:09:49]

Description was changed from

==========
Implement script MIME restrictions for X-Content-Type-Options: nosniff for
Workers

The restrictions for ScriptResources were introduced 4 years ago.
https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd448231...
But the restrictions for worker scripts were not introduced.

BUG=689003
==========

to

==========
Implement script MIME restrictions for X-Content-Type-Options: nosniff for
Workers

The restrictions for ScriptResources were introduced 4 years ago.
https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd448231...
But the restrictions for worker scripts were not introduced.

BUG=689003

Review-Url: https://codereview.chromium.org/2689173002
Cr-Commit-Position: refs/heads/master@{#449937}
Committed:
https://chromium.googlesource.com/chromium/src/+/483690f08302c4e870ca10e7685c...
==========

[commit-bot: I haz the power, 2017-02-13 13:09:51]

Committed patchset #3 (id:60001) as
https://chromium.googlesource.com/chromium/src/+/483690f08302c4e870ca10e7685c...