From 1e7caa84a15f7c7cf590567a4455fa044ed7861d Mon Sep 17 00:00:00 2001
From: Christoph Kerschbaumer <ckerschb@christophkerschbaumer.com>
Date: Wed, 6 Sep 2017 16:27:05 +0200
Subject: [PATCH] Bug 1396798: Do not block toplevel data: navigation to image
 (except svgs). r=smaug

---
 dom/security/nsContentSecurityManager.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/dom/security/nsContentSecurityManager.cpp b/dom/security/nsContentSecurityManager.cpp
index 6cdeeb9d9304..9446de59c227 100644
--- a/dom/security/nsContentSecurityManager.cpp
+++ b/dom/security/nsContentSecurityManager.cpp
@@ -46,13 +46,17 @@ nsContentSecurityManager::AllowTopLevelNavigationToDataURI(
   if (!isDataURI) {
     return true;
   }
+  // Whitelist data: images as long as they are not SVGs
+  nsAutoCString filePath;
+  aURI->GetFilePath(filePath);
+  if (StringBeginsWith(filePath, NS_LITERAL_CSTRING("image/")) &&
+      !StringBeginsWith(filePath, NS_LITERAL_CSTRING("image/svg+xml"))) {
+    return true;
+  }
   if (!aLoadFromExternal &&
       nsContentUtils::IsSystemPrincipal(aTriggeringPrincipal)) {
     return true;
   }
-
-  nsAutoCString spec;
-  aURI->GetSpec(spec);
   NS_ConvertUTF8toUTF16 specUTF16(aURI->GetSpecOrDefault());
   if (specUTF16.Length() > 50) {
     specUTF16.Truncate(50);