From 1253158689f0e697f7f2ce89c570fb8f086675ae Mon Sep 17 00:00:00 2001
From: Andreas Farre <farre@mozilla.com>
Date: Mon, 5 Dec 2022 13:48:29 +0000
Subject: [PATCH] Add tests for ORB nosniff and status conditions.

Differential Revision: https://phabricator.services.mozilla.com/D162822

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1802088
gecko-commit: c1a849c20687395a364be52b21a228b6c7e41ece
gecko-reviewers: sefeng
---
 fetch/orb/resources/sound.mp3          | Bin 0 -> 539 bytes
 fetch/orb/resources/utils.js           |   4 ++
 fetch/orb/tentative/nosniff.sub.any.js |  59 +++++++++++++++++++++++++
 fetch/orb/tentative/status.sub.any.js  |  33 ++++++++++++++
 fetch/orb/tentative/status.sub.html    |  17 +++++++
 5 files changed, 113 insertions(+)
 create mode 100644 fetch/orb/resources/sound.mp3
 create mode 100644 fetch/orb/tentative/nosniff.sub.any.js
 create mode 100644 fetch/orb/tentative/status.sub.any.js
 create mode 100644 fetch/orb/tentative/status.sub.html

diff --git a/fetch/orb/resources/sound.mp3 b/fetch/orb/resources/sound.mp3
new file mode 100644
index 0000000000000000000000000000000000000000..a15d1de328f3f3325cb9589d423abf60d538d838
GIT binary patch
literal 539
zcmeZtF=k-^0p*b3U{@f`&%nU!lUSB!YNlsmpl4`c2$qEq|9?9iK;lA}o_T5cKo(FR
z12Y2y<2!~agup36;6EV%vKi>eWS}F>3_u(hP=PTR-<`~R#tG*A|1EHYf%yOf;}RfO
ufq}uKfq{X=$I;i-SkKZ@&oq=;0A!D5GnzfrG91YqkUhcZ{y~zb783yc<G_~y

literal 0
HcmV?d00001

diff --git a/fetch/orb/resources/utils.js b/fetch/orb/resources/utils.js
index 3517234e2b92003..94a2177f0792bb2 100644
--- a/fetch/orb/resources/utils.js
+++ b/fetch/orb/resources/utils.js
@@ -6,6 +6,10 @@ function contentType(type) {
   return header("Content-Type", type);
 }
 
+function contentTypeOptions(type) {
+  return header("X-Content-Type-Options", type);
+}
+
 function fetchORB(file, options, ...pipe) {
   return fetch(`${file}${pipe.length ? `?pipe=${pipe.join("|")}` : ""}`, {
     ...(options || {}),
diff --git a/fetch/orb/tentative/nosniff.sub.any.js b/fetch/orb/tentative/nosniff.sub.any.js
new file mode 100644
index 000000000000000..3df9d22e0b7beb0
--- /dev/null
+++ b/fetch/orb/tentative/nosniff.sub.any.js
@@ -0,0 +1,59 @@
+// META: script=/fetch/orb/resources/utils.js
+
+const path = "http://{{domains[www1]}}:{{ports[http][0]}}/fetch/orb/resources";
+
+promise_test(
+  t =>
+    promise_rejects_js(
+      t,
+      TypeError,
+      fetchORB(
+        `${path}/text.txt`,
+        null,
+        contentType("text/plain"),
+        contentTypeOptions("nosniff")
+      )
+    ),
+  "ORB should block opaque text/plain with nosniff"
+);
+
+promise_test(
+  t =>
+    promise_rejects_js(
+      t,
+      TypeError,
+      fetchORB(
+        `${path}/data.json`,
+        null,
+        contentType("application/json"),
+        contentTypeOptions("nosniff")
+      )
+    ),
+  "ORB should block opaque-response-blocklisted MIME type with nosniff"
+);
+
+promise_test(
+  t =>
+    promise_rejects_js(
+      t,
+      TypeError,
+      fetchORB(
+        `${path}/data.json`,
+        null,
+        contentType(""),
+        contentTypeOptions("nosniff")
+      )
+    ),
+  "ORB should block opaque response with empty Content-Type and nosniff"
+);
+
+promise_test(
+  () =>
+    fetchORB(
+      `${path}/image.png`,
+      null,
+      contentType(""),
+      contentTypeOptions("nosniff")
+    ),
+  "ORB shouldn't block opaque image with empty Content-Type and nosniff"
+);
diff --git a/fetch/orb/tentative/status.sub.any.js b/fetch/orb/tentative/status.sub.any.js
new file mode 100644
index 000000000000000..b94d8b7f6359a7d
--- /dev/null
+++ b/fetch/orb/tentative/status.sub.any.js
@@ -0,0 +1,33 @@
+// META: script=/fetch/orb/resources/utils.js
+
+const path = "http://{{domains[www1]}}:{{ports[http][0]}}/fetch/orb/resources";
+
+promise_test(
+  t =>
+    promise_rejects_js(
+      t,
+      TypeError,
+      fetchORB(
+        `${path}/data.json`,
+        null,
+        contentType("application/json"),
+        "status(206)"
+      )
+    ),
+  "ORB should block opaque-response-blocklisted MIME type with status 206"
+);
+
+promise_test(
+  t =>
+    promise_rejects_js(
+      t,
+      TypeError,
+      fetchORB(
+        `${path}/data.json`,
+        null,
+        contentType("application/json"),
+        "status(302)"
+      )
+    ),
+  "ORB should block opaque response with non-ok status"
+);
diff --git a/fetch/orb/tentative/status.sub.html b/fetch/orb/tentative/status.sub.html
new file mode 100644
index 000000000000000..a62bdeb35e469a6
--- /dev/null
+++ b/fetch/orb/tentative/status.sub.html
@@ -0,0 +1,17 @@
+'use strict';
+
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+async_test(function(t) {
+  let url = "http://{{domains[www1]}}:{{ports[http][0]}}"
+  url = `${url}/fetch/orb/resources/sound.mp3?pipe=status(301)|header(Content-Type,)`
+
+  const video = document.createElement("video");
+  video.src = url;
+  video.onerror = t.step_func_done();
+  video.onload = t.unreached_func("Unexpected error event");
+  document.body.appendChild(video);
+}, "ORB should block initial media requests with status not 200 or 206");
+</script>