Changeset 289672 in webkit


Ignore:
Timestamp:
Feb 11, 2022 2:57:33 PM (5 months ago)
Author:
Chris Dumez
Message:

Fix MIME type check for classic worker script fetches
​https://bugs.webkit.org/show_bug.cgi?id=236411

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

  • web-platform-tests/workers/Worker_script_mimetype-expected.txt:
  • web-platform-tests/workers/importscripts_mime.any.sharedworker-expected.txt:
  • web-platform-tests/workers/importscripts_mime.any.worker-expected.txt:

Rebaseline WPT tests now that more checks are passing.

  • web-platform-tests/workers/constructors/SharedWorker/Infinity.headers: Added.
  • web-platform-tests/workers/constructors/SharedWorker/NaN.headers: Added.

Merge upstream fix from ​https://github.com/web-platform-tests/wpt/pull/32782.

Source/WebCore:

Fix MIME type check for classic worker script fetches and classic worker script imports, so that we are
now aligned with the specification:

This was causing us to fail some Web Platform Tests.

No new tests, rebaselined existing tests.

  • bindings/js/WorkerModuleScriptLoader.cpp:

(WebCore::WorkerModuleScriptLoader::load):

  • loader/FetchOptions.h:

(WebCore::isScriptLikeDestination):

  • workers/Worker.cpp:

(WebCore::Worker::create):

  • workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::importScripts):

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously):
(WebCore::WorkerScriptLoader::loadAsynchronously):
(WebCore::constructJavaScriptMIMETypeError):
(WebCore::WorkerScriptLoader::validateWorkerResponse):
(WebCore::WorkerScriptLoader::didReceiveResponse):

  • workers/WorkerScriptLoader.h:
  • workers/service/ServiceWorkerJob.cpp:

(WebCore::ServiceWorkerJob::fetchScriptWithContext):

  • workers/shared/SharedWorkerScriptLoader.cpp:

(WebCore::SharedWorkerScriptLoader::load):

Source/WebKit:

  • NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp:

(WebKit::ServiceWorkerSoftUpdateLoader::processResponse):

LayoutTests:

Fix existing layout tests to make sure that worker scripts are served with a JavaScript mime type.

  • http/tests/resourceLoadStatistics/resources/script-revealing-cookies.py:
  • http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-allowed.py:
  • http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-blocked.py:
  • http/tests/security/contentSecurityPolicy/resources/worker-xhr-allowed.py:
  • http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-allowed.py:
  • http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.py:
  • http/tests/security/contentSecurityPolicy/resources/worker.py:
  • http/tests/workers/resources/subworker-encoded.py:
Location:
trunk
Files:
2 added
24 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r289668 r289672  
     12022-02-11  Chris Dumez  <cdumez@apple.com>
     2
     3        Fix MIME type check for classic worker script fetches
     4        https://bugs.webkit.org/show_bug.cgi?id=236411
     5
     6        Reviewed by Alex Christensen.
     7
     8        Fix existing layout tests to make sure that worker scripts are served with a JavaScript mime type.
     9
     10        * http/tests/resourceLoadStatistics/resources/script-revealing-cookies.py:
     11        * http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-allowed.py:
     12        * http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-blocked.py:
     13        * http/tests/security/contentSecurityPolicy/resources/worker-xhr-allowed.py:
     14        * http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-allowed.py:
     15        * http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.py:
     16        * http/tests/security/contentSecurityPolicy/resources/worker.py:
     17        * http/tests/workers/resources/subworker-encoded.py:
     18
    1192022-02-11  Antoine Quint  <graouts@webkit.org>
    220

  • trunk/LayoutTests/http/tests/resourceLoadStatistics/resources/script-revealing-cookies.py

    r274975 r289672  
    1919first_party_cookie = cookies.get('firstPartyCookie', None)
    2020
    21 sys.stdout.write('Content-Type: text/html\r\n\r\n')
     21sys.stdout.write('Content-Type: text/javascript\r\n\r\n')
    2222
    2323if first_party_cookie:

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-allowed.py

    r274671 r289672  
    66determine_content_security_policy_header()
    77sys.stdout.write(
    8     'Content-Type: text/html\r\n\r\n'
     8    'Content-Type: text/javascript\r\n\r\n'
    99    'self.result = false;\n'
    1010    'var exception;\n'

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-blocked.py

    r274671 r289672  
    66determine_content_security_policy_header()
    77sys.stdout.write(
    8     'Content-Type: text/html\r\n\r\n'
     8    'Content-Type: text/javascript\r\n\r\n'
    99    'var exception;\n'
    1010    'try {\n'

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker-xhr-allowed.py

    r274671 r289672  
    66determine_content_security_policy_header()
    77sys.stdout.write(
    8     'Content-Type: text/html\r\n\r\n'
     8    'Content-Type: text/javascript\r\n\r\n'
    99    'var isAsynchronous = false;\n'
    1010    'var xhr = new XMLHttpRequest;\n'

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-allowed.py

    r274671 r289672  
    55
    66sys.stdout.write(
    7     'Content-Type: text/html\r\n\r\n'
     7    'Content-Type: text/javascript\r\n\r\n'
    88    'var isAsynchronous = false;\n'
    99    'var xhr = new XMLHttpRequest;\n'

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.py

    r274671 r289672  
    66determine_content_security_policy_header()
    77sys.stdout.write(
    8     'Content-Type: text/html\r\n\r\n'
     8    'Content-Type: text/javascript\r\n\r\n'
    99    'var expectedExceptionCode = 19; // DOMException.NETWORK_ERR\n'
    1010    'var isAsynchronous = false;\n'

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/worker.py

    r277964 r289672  
    1313    'Cache-Control: no-cache, must-revalidate\r\n'
    1414    'Pragma: no-cache\r\n'
    15     'Content-Type: text/html\r\n'
     15    'Content-Type: text/javascript\r\n'
    1616)
    1717

  • trunk/LayoutTests/http/tests/workers/resources/subworker-encoded.py

    r274768 r289672  
    1111    'Cache-Control: no-cache, must-revalidate\r\n'
    1212    'Pragma: no-cache\r\n'
    13     'Content-Type: text/html\r\n\r\n'
     13    'Content-Type: text/javascript\r\n\r\n'
    1414    'postMessage(\'Sub: Original test string: \' + String.fromCharCode(0x41F, 0x440, 0x438, 0x432, 0x435, 0x442));'
    1515    'postMessage(\'Sub: Test string encoded using koi8-r: {}.\');'

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r289631 r289672  
     12022-02-11  Chris Dumez  <cdumez@apple.com>
     2
     3        Fix MIME type check for classic worker script fetches
     4        https://bugs.webkit.org/show_bug.cgi?id=236411
     5
     6        Reviewed by Alex Christensen.
     7
     8        * web-platform-tests/workers/Worker_script_mimetype-expected.txt:
     9        * web-platform-tests/workers/importscripts_mime.any.sharedworker-expected.txt:
     10        * web-platform-tests/workers/importscripts_mime.any.worker-expected.txt:
     11        Rebaseline WPT tests now that more checks are passing.
     12
     13        * web-platform-tests/workers/constructors/SharedWorker/Infinity.headers: Added.
     14        * web-platform-tests/workers/constructors/SharedWorker/NaN.headers: Added.
     15        Merge upstream fix from https://github.com/web-platform-tests/wpt/pull/32782.
     16
    1172022-02-11  Jon Lee  <jonlee@apple.com>
    218

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/Worker_script_mimetype-expected.txt

    r279602 r289672  
    11
    2 FAIL HTTP(S) URLs which respond with text/plain MIME type must not work assert_unreached: Worker should not recieve messages Reached unreachable code
     2PASS HTTP(S) URLs which respond with text/plain MIME type must not work
    33PASS blob: URLs should load, despite no MIME type for the backing Blob
    44PASS blob: URLs should load, despite the wrong MIME type for the backing Blob

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/importscripts_mime.any.sharedworker-expected.txt

    r289116 r289672  
    66PASS importScripts() requires scripty MIME types: text/csv is blocked.
    77PASS importScripts() requires scripty MIME types: video/mpeg is blocked.
    8 FAIL importScripts() requires scripty MIME types: text/html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    9 FAIL importScripts() requires scripty MIME types: text/plain is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    10 FAIL importScripts() requires scripty MIME types: application/xml is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    11 FAIL importScripts() requires scripty MIME types: application/octet-stream is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    12 FAIL importScripts() requires scripty MIME types: text/potato is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    13 FAIL importScripts() requires scripty MIME types: potato/text is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    14 FAIL importScripts() requires scripty MIME types: aaa/aaa is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    15 FAIL importScripts() requires scripty MIME types: zzz/zzz is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
     8PASS importScripts() requires scripty MIME types: text/html is blocked.
     9PASS importScripts() requires scripty MIME types: text/plain is blocked.
     10PASS importScripts() requires scripty MIME types: application/xml is blocked.
     11PASS importScripts() requires scripty MIME types: application/octet-stream is blocked.
     12PASS importScripts() requires scripty MIME types: text/potato is blocked.
     13PASS importScripts() requires scripty MIME types: potato/text is blocked.
     14PASS importScripts() requires scripty MIME types: aaa/aaa is blocked.
     15PASS importScripts() requires scripty MIME types: zzz/zzz is blocked.
    1616PASS importScripts() requires scripty MIME types: text/javascript; charset=utf-8 is allowed.
    1717PASS importScripts() requires scripty MIME types: text/javascript;charset=utf-8 is allowed.
    … …  
    2020PASS importScripts() requires scripty MIME types: text/csv;charset=utf-8 is blocked.
    2121PASS importScripts() requires scripty MIME types: text/csv;bla;bla is blocked.
    22 FAIL importScripts() requires scripty MIME types: Text/html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    23 FAIL importScripts() requires scripty MIME types: text/Html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    24 FAIL importScripts() requires scripty MIME types: TeXt/HtMl is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    25 FAIL importScripts() requires scripty MIME types: TEXT/HTML is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
     22PASS importScripts() requires scripty MIME types: Text/html is blocked.
     23PASS importScripts() requires scripty MIME types: text/Html is blocked.
     24PASS importScripts() requires scripty MIME types: TeXt/HtMl is blocked.
     25PASS importScripts() requires scripty MIME types: TEXT/HTML is blocked.
    2626

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/importscripts_mime.any.worker-expected.txt

    r267649 r289672  
    66PASS importScripts() requires scripty MIME types: text/csv is blocked.
    77PASS importScripts() requires scripty MIME types: video/mpeg is blocked.
    8 FAIL importScripts() requires scripty MIME types: text/html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    9 FAIL importScripts() requires scripty MIME types: text/plain is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    10 FAIL importScripts() requires scripty MIME types: application/xml is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    11 FAIL importScripts() requires scripty MIME types: application/octet-stream is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    12 FAIL importScripts() requires scripty MIME types: text/potato is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    13 FAIL importScripts() requires scripty MIME types: potato/text is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    14 FAIL importScripts() requires scripty MIME types: aaa/aaa is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    15 FAIL importScripts() requires scripty MIME types: zzz/zzz is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
     8PASS importScripts() requires scripty MIME types: text/html is blocked.
     9PASS importScripts() requires scripty MIME types: text/plain is blocked.
     10PASS importScripts() requires scripty MIME types: application/xml is blocked.
     11PASS importScripts() requires scripty MIME types: application/octet-stream is blocked.
     12PASS importScripts() requires scripty MIME types: text/potato is blocked.
     13PASS importScripts() requires scripty MIME types: potato/text is blocked.
     14PASS importScripts() requires scripty MIME types: aaa/aaa is blocked.
     15PASS importScripts() requires scripty MIME types: zzz/zzz is blocked.
    1616PASS importScripts() requires scripty MIME types: text/javascript; charset=utf-8 is allowed.
    1717PASS importScripts() requires scripty MIME types: text/javascript;charset=utf-8 is allowed.
    … …  
    2020PASS importScripts() requires scripty MIME types: text/csv;charset=utf-8 is blocked.
    2121PASS importScripts() requires scripty MIME types: text/csv;bla;bla is blocked.
    22 FAIL importScripts() requires scripty MIME types: Text/html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    23 FAIL importScripts() requires scripty MIME types: text/Html is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    24 FAIL importScripts() requires scripty MIME types: TeXt/HtMl is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
    25 FAIL importScripts() requires scripty MIME types: TEXT/HTML is blocked. assert_throws_dom: function "_ => { importScripts(import_url) }" did not throw
     22PASS importScripts() requires scripty MIME types: Text/html is blocked.
     23PASS importScripts() requires scripty MIME types: text/Html is blocked.
     24PASS importScripts() requires scripty MIME types: TeXt/HtMl is blocked.
     25PASS importScripts() requires scripty MIME types: TEXT/HTML is blocked.
    2626

  • trunk/Source/WebCore/ChangeLog

    r289666 r289672  
     12022-02-11  Chris Dumez  <cdumez@apple.com>
     2
     3        Fix MIME type check for classic worker script fetches
     4        https://bugs.webkit.org/show_bug.cgi?id=236411
     5
     6        Reviewed by Alex Christensen.
     7
     8        Fix MIME type check for classic worker script fetches and classic worker script imports, so that we are
     9        now aligned with the specification:
     10        - https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-script (Step 5)
     11        - https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-imported-script (Step 5)
     12
     13        This was causing us to fail some Web Platform Tests.
     14
     15        No new tests, rebaselined existing tests.
     16
     17        * bindings/js/WorkerModuleScriptLoader.cpp:
     18        (WebCore::WorkerModuleScriptLoader::load):
     19        * loader/FetchOptions.h:
     20        (WebCore::isScriptLikeDestination):
     21        * workers/Worker.cpp:
     22        (WebCore::Worker::create):
     23        * workers/WorkerGlobalScope.cpp:
     24        (WebCore::WorkerGlobalScope::importScripts):
     25        * workers/WorkerScriptLoader.cpp:
     26        (WebCore::WorkerScriptLoader::loadSynchronously):
     27        (WebCore::WorkerScriptLoader::loadAsynchronously):
     28        (WebCore::constructJavaScriptMIMETypeError):
     29        (WebCore::WorkerScriptLoader::validateWorkerResponse):
     30        (WebCore::WorkerScriptLoader::didReceiveResponse):
     31        * workers/WorkerScriptLoader.h:
     32        * workers/service/ServiceWorkerJob.cpp:
     33        (WebCore::ServiceWorkerJob::fetchScriptWithContext):
     34        * workers/shared/SharedWorkerScriptLoader.cpp:
     35        (WebCore::SharedWorkerScriptLoader::load):
     36
    1372022-02-11  Antoine Quint  <graouts@webkit.org>
    238

  • trunk/Source/WebCore/bindings/js/WorkerModuleScriptLoader.cpp

    r288701 r289672  
    9494    }
    9595
    96     m_scriptLoader->loadAsynchronously(context, WTFMove(request), WTFMove(fetchOptions), contentSecurityPolicyEnforcement, ServiceWorkersMode::All, *this, taskMode());
     96    m_scriptLoader->loadAsynchronously(context, WTFMove(request), WorkerScriptLoader::Source::ModuleScript, WTFMove(fetchOptions), contentSecurityPolicyEnforcement, ServiceWorkersMode::All, *this, taskMode());
    9797    return true;
    9898}

  • trunk/Source/WebCore/loader/FetchOptions.h

    r286288 r289672  
    108108        || destination == FetchOptions::Destination::Script
    109109        || destination == FetchOptions::Destination::Serviceworker
     110        || destination == FetchOptions::Destination::Sharedworker
    110111        || destination == FetchOptions::Destination::Worker;
    111112}

  • trunk/Source/WebCore/workers/Worker.cpp

    r289483 r289672  
    114114    request.setInitiatorIdentifier(worker->m_identifier);
    115115
    116     worker->m_scriptLoader->loadAsynchronously(context, WTFMove(request), workerFetchOptions(worker->m_options, FetchOptions::Destination::Worker), contentSecurityPolicyEnforcement, ServiceWorkersMode::All, worker.get(), WorkerRunLoop::defaultMode());
     116    auto source = options.type == WorkerType::Module ? WorkerScriptLoader::Source::ModuleScript : WorkerScriptLoader::Source::ClassicWorkerScript;
     117    worker->m_scriptLoader->loadAsynchronously(context, WTFMove(request), source, workerFetchOptions(worker->m_options, FetchOptions::Destination::Worker), contentSecurityPolicyEnforcement, ServiceWorkersMode::All, worker.get(), WorkerRunLoop::defaultMode());
    117118
    118119    return worker;

  • trunk/Source/WebCore/workers/WorkerGlobalScope.cpp

    r289236 r289672  
    383383        auto scriptLoader = WorkerScriptLoader::create();
    384384        auto cspEnforcement = shouldBypassMainWorldContentSecurityPolicy ? ContentSecurityPolicyEnforcement::DoNotEnforce : ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective;
    385         if (auto exception = scriptLoader->loadSynchronously(this, url, FetchOptions::Mode::NoCors, cachePolicy, cspEnforcement, resourceRequestIdentifier()))
     385        if (auto exception = scriptLoader->loadSynchronously(this, url, WorkerScriptLoader::Source::ClassicWorkerImport, FetchOptions::Mode::NoCors, cachePolicy, cspEnforcement, resourceRequestIdentifier()))
    386386            return WTFMove(*exception);
    387387

  • trunk/Source/WebCore/workers/WorkerScriptLoader.cpp

    r289489 r289672  
    5353WorkerScriptLoader::~WorkerScriptLoader() = default;
    5454
    55 std::optional<Exception> WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const URL& url, FetchOptions::Mode mode, FetchOptions::Cache cachePolicy, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, const String& initiatorIdentifier)
     55std::optional<Exception> WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const URL& url, Source source, FetchOptions::Mode mode, FetchOptions::Cache cachePolicy, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, const String& initiatorIdentifier)
    5656{
    5757    ASSERT(scriptExecutionContext);
    … …  
    6060    m_url = url;
    6161    m_lastRequestURL = url;
     62    m_source = source;
    6263    m_destination = FetchOptions::Destination::Script;
    6364    m_isCOEPEnabled = scriptExecutionContext->settingsValues().crossOriginEmbedderPolicyEnabled;
    … …  
    115116}
    116117
    117 void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext& scriptExecutionContext, ResourceRequest&& scriptRequest, FetchOptions&& fetchOptions, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, ServiceWorkersMode serviceWorkerMode, WorkerScriptLoaderClient& client, String&& taskMode)
     118void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext& scriptExecutionContext, ResourceRequest&& scriptRequest, Source source, FetchOptions&& fetchOptions, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, ServiceWorkersMode serviceWorkerMode, WorkerScriptLoaderClient& client, String&& taskMode)
    118119{
    119120    m_client = &client;
    120121    m_url = scriptRequest.url();
    121122    m_lastRequestURL = scriptRequest.url();
     123    m_source = source;
    122124    m_destination = fetchOptions.destination;
    123125    m_isCOEPEnabled = scriptExecutionContext.settingsValues().crossOriginEmbedderPolicyEnabled;
    … …  
    164166}
    165167
    166 ResourceError WorkerScriptLoader::validateWorkerResponse(const ResourceResponse& response, FetchOptions::Destination destination)
     168static ResourceError constructJavaScriptMIMETypeError(const ResourceResponse& response)
     169{
     170    auto message = makeString("Refused to execute ", response.url().stringCenterEllipsizedToLength(), " as script because ", response.mimeType(), " is not a script MIME type.");
     171    return { errorDomainWebKitInternal, 0, response.url(), WTFMove(message), ResourceError::Type::AccessControl };
     172}
     173
     174ResourceError WorkerScriptLoader::validateWorkerResponse(const ResourceResponse& response, Source source, FetchOptions::Destination destination)
    167175{
    168176    if (response.httpStatusCode() / 100 != 2 && response.httpStatusCode())
    … …  
    174182    }
    175183
    176     if (shouldBlockResponseDueToMIMEType(response, destination)) {
    177         auto message = makeString("Refused to execute ", response.url().stringCenterEllipsizedToLength(), " as script because ", response.mimeType(), " is not a script MIME type.");
    178         return { errorDomainWebKitInternal, 0, response.url(), WTFMove(message), ResourceError::Type::General };
     184    switch (source) {
     185    case Source::ClassicWorkerScript:
     186        // https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-script (Step 5)
     187        // This is the result a dedicated / shared / service worker script fetch.
     188        if (response.url().protocolIsInHTTPFamily() && !MIMETypeRegistry::isSupportedJavaScriptMIMEType(response.mimeType()))
     189            return constructJavaScriptMIMETypeError(response);
     190        break;
     191    case Source::ClassicWorkerImport:
     192        // https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-imported-script (Step 5).
     193        // This is the result of an importScripts() call.
     194        if (!MIMETypeRegistry::isSupportedJavaScriptMIMEType(response.mimeType()))
     195            return constructJavaScriptMIMETypeError(response);
     196        break;
     197    case Source::ModuleScript:
     198        if (shouldBlockResponseDueToMIMEType(response, destination))
     199            return constructJavaScriptMIMETypeError(response);
     200        break;
    179201    }
    180202
    … …  
    189211void WorkerScriptLoader::didReceiveResponse(ResourceLoaderIdentifier identifier, const ResourceResponse& response)
    190212{
    191     m_error = validateWorkerResponse(response, m_destination);
     213    m_error = validateWorkerResponse(response, m_source, m_destination);
    192214    if (!m_error.isNull()) {
    193215        m_failed = true;

  • trunk/Source/WebCore/workers/WorkerScriptLoader.h

    r289489 r289672  
    6161    }
    6262
    63     std::optional<Exception> loadSynchronously(ScriptExecutionContext*, const URL&, FetchOptions::Mode, FetchOptions::Cache, ContentSecurityPolicyEnforcement, const String& initiatorIdentifier);
    64     void loadAsynchronously(ScriptExecutionContext&, ResourceRequest&&, FetchOptions&&, ContentSecurityPolicyEnforcement, ServiceWorkersMode, WorkerScriptLoaderClient&, String&& taskMode);
     63    enum class Source : uint8_t { ClassicWorkerScript, ClassicWorkerImport, ModuleScript };
     64
     65    std::optional<Exception> loadSynchronously(ScriptExecutionContext*, const URL&, Source, FetchOptions::Mode, FetchOptions::Cache, ContentSecurityPolicyEnforcement, const String& initiatorIdentifier);
     66    void loadAsynchronously(ScriptExecutionContext&, ResourceRequest&&, Source, FetchOptions&&, ContentSecurityPolicyEnforcement, ServiceWorkersMode, WorkerScriptLoaderClient&, String&& taskMode);
    6567
    6668    void notifyError();
    … …  
    9193    void cancel();
    9294
    93     WEBCORE_EXPORT static ResourceError validateWorkerResponse(const ResourceResponse&, FetchOptions::Destination);
     95    WEBCORE_EXPORT static ResourceError validateWorkerResponse(const ResourceResponse&, Source, FetchOptions::Destination);
    9496
    9597private:
    … …  
    112114    CertificateInfo m_certificateInfo;
    113115    String m_responseMIMEType;
     116    Source m_source;
    114117    FetchOptions::Destination m_destination;
    115118    ContentSecurityPolicyResponseHeaders m_contentSecurityPolicy;

  • trunk/Source/WebCore/workers/service/ServiceWorkerJob.cpp

    r289483 r289672  
    114114    options.destination = FetchOptions::Destination::Serviceworker;
    115115    options.credentials = FetchOptions::Credentials::SameOrigin;
    116     m_scriptLoader->loadAsynchronously(context, WTFMove(request), WTFMove(options), ContentSecurityPolicyEnforcement::DoNotEnforce, ServiceWorkersMode::None, *this, WorkerRunLoop::defaultMode());
     116
     117    auto source = m_jobData.workerType == WorkerType::Module ? WorkerScriptLoader::Source::ModuleScript : WorkerScriptLoader::Source::ClassicWorkerScript;
     118    m_scriptLoader->loadAsynchronously(context, WTFMove(request), source, WTFMove(options), ContentSecurityPolicyEnforcement::DoNotEnforce, ServiceWorkersMode::None, *this, WorkerRunLoop::defaultMode());
    117119}
    118120

  • trunk/Source/WebCore/workers/shared/SharedWorkerScriptLoader.cpp

    r289483 r289672  
    4949    m_completionHandler = WTFMove(completionHandler);
    5050
    51     m_loader->loadAsynchronously(*m_worker->scriptExecutionContext(), ResourceRequest(m_url), m_worker->workerFetchOptions(m_options, FetchOptions::Destination::Sharedworker), ContentSecurityPolicyEnforcement::EnforceWorkerSrcDirective, ServiceWorkersMode::All, *this, WorkerRunLoop::defaultMode());
     51    auto source = m_options.type == WorkerType::Module ? WorkerScriptLoader::Source::ModuleScript : WorkerScriptLoader::Source::ClassicWorkerScript;
     52    m_loader->loadAsynchronously(*m_worker->scriptExecutionContext(), ResourceRequest(m_url), source, m_worker->workerFetchOptions(m_options, FetchOptions::Destination::Sharedworker), ContentSecurityPolicyEnforcement::EnforceWorkerSrcDirective, ServiceWorkersMode::All, *this, WorkerRunLoop::defaultMode());
    5253}
    5354

  • trunk/Source/WebKit/ChangeLog

    r289665 r289672  
     12022-02-11  Chris Dumez  <cdumez@apple.com>
     2
     3        Fix MIME type check for classic worker script fetches
     4        https://bugs.webkit.org/show_bug.cgi?id=236411
     5
     6        Reviewed by Alex Christensen.
     7
     8        * NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp:
     9        (WebKit::ServiceWorkerSoftUpdateLoader::processResponse):
     10
    1112022-02-11  Wenson Hsieh  <wenson_hsieh@apple.com>
    212

  • trunk/Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp

    r289483 r289672  
    161161ResourceError ServiceWorkerSoftUpdateLoader::processResponse(const ResourceResponse& response)
    162162{
    163     auto error = WorkerScriptLoader::validateWorkerResponse(response, FetchOptions::Destination::Serviceworker);
     163    auto source = m_jobData.workerType == WorkerType::Module ? WorkerScriptLoader::Source::ModuleScript : WorkerScriptLoader::Source::ClassicWorkerScript;
     164    auto error = WorkerScriptLoader::validateWorkerResponse(response, source, FetchOptions::Destination::Serviceworker);
    164165    if (!error.isNull())
    165166        return error;
Note: See TracChangeset for help on using the changeset viewer.