New issue
Advanced search Search tips

Issue 689003 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

`nosniff` should apply to `importScript()`

Project Member Reported by mkwst@chromium.org, Feb 6 2017

Issue description

According to https://github.com/w3c/ServiceWorker/issues/1032#issuecomment-267683646, `importScripts()` imports a script served with `Content-Type:"text/html"` and `X-Content-Type-Options:"nosniff"`. We should be applying `nosniff` to that script load.

I thought `importScripts()` eventually ran through https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/ScriptLoader.cpp?rcl=92c26eed9fd8834e1da3283e8bd45952aa4f0d6b&l=483, but it apparently doesn't? Or we're not catching the headers correctly? Either way, seems like we should fix it.
 

Comment 1 by horo@chromium.org, Feb 10 2017

Components: Blink>ServiceWorker
Owner: horo@chromium.org
Status: Assigned (was: Available)
I'll take this issue.
Project Member

Comment 2 by bugdroid1@chromium.org, Feb 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/483690f08302c4e870ca10e7685cc9b551bd43c7

commit 483690f08302c4e870ca10e7685cc9b551bd43c7
Author: horo <horo@chromium.org>
Date: Mon Feb 13 13:09:14 2017

Implement script MIME restrictions for X-Content-Type-Options: nosniff for Workers

The restrictions for ScriptResources were introduced 4 years ago.
https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd4482313a078378680f
But the restrictions for worker scripts were not introduced.

BUG= 689003 

Review-Url: https://codereview.chromium.org/2689173002
Cr-Commit-Position: refs/heads/master@{#449937}

[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/MANIFEST.json
[add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm
[add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm
[add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/support/ImportScriptsNosniffErr.js
[add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/support/nosiniff-error-worker.py
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/loader/resource/ScriptResource.h
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/workers/WorkerScriptLoader.cpp
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/network/ResourceResponse.cpp
[modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/network/ResourceResponse.h

Comment 3 by horo@chromium.org, Feb 14 2017

Status: Fixed (was: Assigned)

Sign in to add a comment