Bug 741526 - Mozilla central mozapps implementation ignores Content-Type. r=fabrice

dom/apps/src/AppsUtils.jsm

@@ -184,6 +184,14 @@ this.AppsUtils = {
     return true;
   },
 
+  checkManifestContentType(installOrigin, webappOrigin, contentType) {
+    if (installOrigin != webappOrigin && contentType != "application/x-web-app-manifest+json") {
+      return false;
+    }
+
+    return true;
+  },
+
   /**
    * Determines whether the manifest allows installs for the given origin.
    * @param object aManifest

dom/apps/src/Webapps.js

@@ -105,6 +105,11 @@ WebappsRegistry.prototype = {
 
     xhr.addEventListener("load", (function() {
       if (xhr.status == 200) {
+        if (!AppsUtils.checkManifestContentType(installOrigin, this._getOrigin(aURL), xhr.getResponseHeader("content-type"))) {
+          Services.DOMRequest.fireError(request, "INVALID_MANIFEST");
+          return;
+        }
+
         let manifest;
         try {
           manifest = JSON.parse(xhr.responseText, installOrigin);
@@ -214,6 +219,11 @@ WebappsRegistry.prototype = {
 
     xhr.addEventListener("load", (function() {
       if (xhr.status == 200) {
+        if (!AppsUtils.checkManifestContentType(installOrigin, this._getOrigin(aURL), xhr.getResponseHeader("content-type"))) {
+          Services.DOMRequest.fireError(request, "INVALID_MANIFEST");
+          return;
+        }
+
         let manifest;
         try {
           manifest = JSON.parse(xhr.responseText, installOrigin);

dom/tests/mochitest/webapps/test_install_errors.xul

@@ -97,7 +97,7 @@ function invalidContent(next) {
   };
 
   request.onsuccess = function onInstall() {
-    todo(false, "manifest with bad content type fails");
+    ok(false, "manifest with bad content type should fail");
     this.result.uninstall().onsuccess = function onUninstall() {
       next();
     };