From b84cbecacd114102e1884a6169388d7cb7ea325d Mon Sep 17 00:00:00 2001 From: Zack Deveau Date: Wed, 28 Feb 2024 16:49:11 -0500 Subject: [PATCH] include the HTTP Permissions-Policy on non-HTML Content-Types [CVE-2024-28103] The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This change allows all Content-Types to serve the configured Permissions-Policy as there are many non-HTML Content-Types that would benefit from this header. (examples include image/svg+xml and application/xml) --- .../http/permissions_policy.rb | 7 --- .../test/dispatch/permissions_policy_test.rb | 51 +++++++++++++++++++ 2 files changed, 51 insertions(+), 7 deletions(-) diff --git a/actionpack/lib/action_dispatch/http/permissions_policy.rb b/actionpack/lib/action_dispatch/http/permissions_policy.rb index 5666ad0acb006..6ec9087e37bd9 100644 --- a/actionpack/lib/action_dispatch/http/permissions_policy.rb +++ b/actionpack/lib/action_dispatch/http/permissions_policy.rb @@ -37,7 +37,6 @@ def call(env) request = ActionDispatch::Request.new(env) _, headers, _ = response = @app.call(env) - return response unless html_response?(headers) return response if policy_present?(headers) if policy = request.permissions_policy @@ -52,12 +51,6 @@ def call(env) end private - def html_response?(headers) - if content_type = headers[CONTENT_TYPE] - /html/.match?(content_type) - end - end - def policy_present?(headers) headers[POLICY] end