From 5aff2e1d83cbe6bbaf6ae6db0fed41adc456286d Mon Sep 17 00:00:00 2001
From: hackademix
Date: Wed, 18 Mar 2020 22:51:07 +0100
Subject: Prevent ANY redirection to data: URIs in documents.

---
 src/lib/CSP.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/CSP.js b/src/lib/CSP.js
index f5a2161..ad0afa2 100644
--- a/src/lib/CSP.js
+++ b/src/lib/CSP.js
@@ -22,7 +22,7 @@ class CSP {
 CSP.isEmbedType = type => /\b(?:application|video|audio)\b/.test(type) && type !== "application/xhtml+xml";
 CSP.headerName = "content-security-policy";
 CSP.patchDataURI = (uri, blocker) => {
-  let parts = /^data:(?:[^,;]*ml)(;[^,]*)?,/i.exec(uri);
+  let parts = /^data:(?:[^,;]*ml|unknown-content-type)(;[^,]*)?,/i.exec(uri);
   if (!(blocker && parts)) {
     // not an interesting data: URI, return as it is
     return uri;
@@ -33,6 +33,6 @@ CSP.patchDataURI = (uri, blocker) => {
   }
   // It's a HTML/XML page, let's prepend our CSP blocker to the document
   let patch = parts[0] + encodeURIComponent(
-    `<meta http-equiv="${CSP.headerName}" content="${blocker}">`);
+    `<meta http-equiv="${CSP.headerName}" content="${blocker}"/>`);
   return uri.startsWith(patch) ? uri : patch + uri.substring(parts[0].length);
 }
-- 
cgit v1.2.3