Force CSP inheritance for redirections to data: URIs on Gecko pre-69.

1 files changed, 15 insertions, 0 deletions

diff --git a/src/lib/CSP.js b/src/lib/CSP.js
index 666f4a1..f5a2161 100644
--- a/src/lib/CSP.js
+++ b/src/lib/CSP.js
@@ -21,3 +21,18 @@ class CSP {
 
 CSP.isEmbedType = type => /\b(?:application|video|audio)\b/.test(type) && type !== "application/xhtml+xml";
 CSP.headerName = "content-security-policy";
+CSP.patchDataURI = (uri, blocker) => {
+  let parts = /^data:(?:[^,;]*ml)(;[^,]*)?,/i.exec(uri);
+  if (!(blocker && parts)) {
+    // not an interesting data: URI, return as it is
+    return uri;
+  }
+  if (parts[1]) {
+    // extra encoding info, let's bailout (better safe than sorry)
+    return "data:";
+  }
+  // It's a HTML/XML page, let's prepend our CSP blocker to the document
+  let patch = parts[0] + encodeURIComponent(
+    `<meta http-equiv="${CSP.headerName}" content="${blocker}">`);
+  return uri.startsWith(patch) ? uri : patch + uri.substring(parts[0].length);
+}