Bug 1330383 - fetch original style sheet text using TYPE_OTHER; r?gl draft
authorTom Tromey <tom@tromey.com>
Wed, 13 Sep 2017 13:36:50 -0600
changeset 664233 b384b5c22b45a5d4ed9524e09ea9c7e5f4e4ea5d
parent 664101 4fe84b1f055400878fbbe9ab97077853cfaec048
child 731391 9fe76e170d437cc7d472fbf0943a8b7f1edb9303
push id79641
push userbmo:ttromey@mozilla.com
push dateWed, 13 Sep 2017 19:38:25 +0000
reviewersgl
bugs1330383
milestone57.0a1
Bug 1330383 - fetch original style sheet text using TYPE_OTHER; r?gl Using TYPE_INTERNAL_STYLESHEET here is incorrect because we're not necessarily fetching style sheets -- just some text. This may run afoul of X-Content-Type-Options. MozReview-Commit-ID: HB7YfWwq6CI
devtools/client/styleeditor/test/browser.ini
devtools/client/styleeditor/test/sourcemap-sass/sourcemaps.scss^headers^
devtools/server/actors/stylesheets.js
--- a/devtools/client/styleeditor/test/browser.ini
+++ b/devtools/client/styleeditor/test/browser.ini
@@ -33,16 +33,17 @@ support-files =
   sourcemap-css/contained.css
   sourcemap-css/sourcemaps.css
   sourcemap-css/sourcemaps.css.map
   sourcemap-css/media-rules.css
   sourcemap-css/media-rules.css.map
   sourcemap-css/test-bootstrap-scss.css
   sourcemap-css/test-stylus.css
   sourcemap-sass/sourcemaps.scss
+  sourcemap-sass/sourcemaps.scss^headers^
   sourcemap-sass/media-rules.scss
   sourcemap-styl/test-stylus.styl
   sourcemaps.html
   sourcemaps-inline.html
   sourcemaps-large.html
   sourcemaps-watching.html
   test_private.css
   test_private.html
new file mode 100644
--- /dev/null
+++ b/devtools/client/styleeditor/test/sourcemap-sass/sourcemaps.scss^headers^
@@ -0,0 +1,2 @@
+X-Content-Type-Options: nosniff
+Content-Type: text/plain
--- a/devtools/server/actors/stylesheets.js
+++ b/devtools/server/actors/stylesheets.js
@@ -83,17 +83,22 @@ var OriginalSourceActor = protocol.Actor
       return promise.resolve(this.text);
     }
     let content = this.sourceMap.sourceContentFor(this.url);
     if (content) {
       this.text = content;
       return promise.resolve(content);
     }
     let options = {
-      policy: Ci.nsIContentPolicy.TYPE_INTERNAL_STYLESHEET,
+      // Make sure to use TYPE_OTHER - we are not fetching necessarily
+      // even fetching a style sheet, and anyway we're not planning to
+      // use it as a style sheet per se but rather just for its text;
+      // and this avoids problems with X-Content-Type-Options:
+      // nosniff.  See bug 1330383.
+      policy: Ci.nsIContentPolicy.TYPE_OTHER,
       window: this.window
     };
     return fetch(this.url, options).then(({content: text}) => {
       this.text = text;
       return text;
     });
   },