diff --git a/dom/security/test/cors/test_CrossSiteXHR_cache.html b/dom/security/test/cors/test_CrossSiteXHR_cache.html index 437c9d9d8b7f..77898e38edcb 100644 --- a/dom/security/test/cors/test_CrossSiteXHR_cache.html +++ b/dom/security/test/cors/test_CrossSiteXHR_cache.html @@ -63,7 +63,7 @@ function* runTest() { headers: { "y-my-header": "hello" }, allowHeaders: "y-my-header", }, - { pass: 0, + { pass: 1, method: "GET", headers: { "y-my-header": "hello" }, }, @@ -73,6 +73,21 @@ function* runTest() { allowHeaders: "y-my-header,x-my-header", cacheTime: 3600, }, + { pass: 0, + method: "GET", + headers: { "x-my-header": "myValue", + "y-my-header": "second" }, + }, + { newTest: "*******" }, + { pass: 1, + method: "GET", + headers: { "y-my-header": "hello" }, + allowHeaders: "y-my-header,x-my-header", + }, + { pass: 1, + method: "GET", + headers: { "y-my-header": "hello" }, + }, { pass: 1, method: "GET", headers: { "x-my-header": "myValue", @@ -224,7 +239,7 @@ function* runTest() { method: "PATCH", allowMethods: "PATCH", }, - { pass: 0, + { pass: 1, method: "PATCH", }, { pass: 1, @@ -242,6 +257,15 @@ function* runTest() { method: "PUT", }, { newTest: "*******" }, + { pass: 1, + method: "PATCH", + allowMethods: "PATCH", + cacheTime: 3600, + }, + { pass: 1, + method: "PATCH", + }, + { newTest: "*******" }, { pass: 0, method: "DELETE", }, diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/netwerk/protocol/http/nsCORSListenerProxy.cpp index 938eba5c92d0..8a6f222ad08d 100644 --- a/netwerk/protocol/http/nsCORSListenerProxy.cpp +++ b/netwerk/protocol/http/nsCORSListenerProxy.cpp @@ -50,6 +50,8 @@ using namespace mozilla; using namespace mozilla::net; #define PREFLIGHT_CACHE_SIZE 100 +// 5 seconds is chosen to be compatible with Chromium. +#define PREFLIGHT_DEFAULT_EXPIRY_SECONDS 5 static void LogBlockedRequest(nsIRequest* aRequest, const char* aProperty, const char16_t* aParam, uint32_t aBlockingReason, @@ -1112,27 +1114,27 @@ void nsCORSPreflightListener::AddResultToCache(nsIRequest* aRequest) { // The "Access-Control-Max-Age" header should return an age in seconds. nsAutoCString headerVal; + uint32_t age = 0; Unused << http->GetResponseHeader( NS_LITERAL_CSTRING("Access-Control-Max-Age"), headerVal); if (headerVal.IsEmpty()) { - return; - } - - // Sanitize the string. We only allow 'delta-seconds' as specified by - // http://dev.w3.org/2006/waf/access-control (digits 0-9 with no leading or - // trailing non-whitespace characters). - uint32_t age = 0; - nsACString::const_char_iterator iter, end; - headerVal.BeginReading(iter); - headerVal.EndReading(end); - while (iter != end) { - if (*iter < '0' || *iter > '9') { - return; + age = PREFLIGHT_DEFAULT_EXPIRY_SECONDS; + } else { + // Sanitize the string. We only allow 'delta-seconds' as specified by + // http://dev.w3.org/2006/waf/access-control (digits 0-9 with no leading or + // trailing non-whitespace characters). + nsACString::const_char_iterator iter, end; + headerVal.BeginReading(iter); + headerVal.EndReading(end); + while (iter != end) { + if (*iter < '0' || *iter > '9') { + return; + } + age = age * 10 + (*iter - '0'); + // Cap at 24 hours. This also avoids overflow + age = std::min(age, 86400U); + ++iter; } - age = age * 10 + (*iter - '0'); - // Cap at 24 hours. This also avoids overflow - age = std::min(age, 86400U); - ++iter; } if (!age || !EnsurePreflightCache()) { diff --git a/testing/web-platform/meta/cors/preflight-cache.htm.ini b/testing/web-platform/meta/cors/preflight-cache.htm.ini deleted file mode 100644 index 2f52e604fb5a..000000000000 --- a/testing/web-platform/meta/cors/preflight-cache.htm.ini +++ /dev/null @@ -1,4 +0,0 @@ -[preflight-cache.htm] - [preflight for x-print should be cached] - expected: FAIL - diff --git a/testing/web-platform/tests/cors/preflight-cache.htm b/testing/web-platform/tests/cors/preflight-cache.htm index 0b6138bdffac..b3de663ebc1d 100644 --- a/testing/web-platform/tests/cors/preflight-cache.htm +++ b/testing/web-platform/tests/cors/preflight-cache.htm @@ -60,6 +60,15 @@ test(function() { }, 'preflight for x-print should be cached') +test(function() { + var time = new Date().getTime() + var client = new XMLHttpRequest() + + var id = did_preflight(true, client, {extra:'max_age='}) + did_preflight(false, client, {extra:'max_age=', token: id}) +}, +'age = blank, should be cached') + test(function() { var time = new Date().getTime() var client = new XMLHttpRequest()