Ensure that the response-origin of range requests match the full requ…

…est (issue 12744)

The following cases are excluded in the patch:
 - The Firefox PDF Viewer, since it has been fixed on the platform side already; please see https://bugzilla.mozilla.org/show_bug.cgi?id=1683940

 - The `PDFNodeStream`-implementation, used in Node.js environments, since after recent changes that code only supports `file://`-URLs.

src/display/fetch_stream.js

@@ -18,6 +18,7 @@ import {
   createHeaders,
   createResponseStatusError,
   extractFilenameFromHeader,
+  getResponseOrigin,
   validateRangeRequestCapabilities,
   validateResponseStatus,
 } from "./network_utils.js";
@@ -52,6 +53,8 @@ function getArrayBuffer(val) {
 
 /** @implements {IPDFStream} */
 class PDFFetchStream {
+  _responseOrigin = null;
+
   constructor(source) {
     this.source = source;
     this.isHttp = /^https?:/i.test(source.url);
@@ -121,6 +124,8 @@ class PDFFetchStreamReader {
       createFetchOptions(headers, this._withCredentials, this._abortController)
     )
       .then(response => {
+        stream._responseOrigin = getResponseOrigin(response.url);
+
         if (!validateResponseStatus(response.status)) {
           throw createResponseStatusError(response.status, url);
         }
@@ -217,6 +222,12 @@ class PDFFetchStreamRangeReader {
       createFetchOptions(headers, this._withCredentials, this._abortController)
     )
       .then(response => {
+        const responseOrigin = getResponseOrigin(response.url);
+        if (responseOrigin !== stream._responseOrigin) {
+          throw new Error(
+            `Expected range response-origin "${responseOrigin}" to match "${stream._responseOrigin}".`
+          );
+        }
         if (!validateResponseStatus(response.status)) {
           throw createResponseStatusError(response.status, url);
         }

src/display/network.js

@@ -18,6 +18,7 @@ import {
   createHeaders,
   createResponseStatusError,
   extractFilenameFromHeader,
+  getResponseOrigin,
   validateRangeRequestCapabilities,
 } from "./network_utils.js";
 
@@ -39,6 +40,8 @@ function getArrayBuffer(xhr) {
 }
 
 class NetworkManager {
+  _responseOrigin = null;
+
   constructor({ url, httpHeaders, withCredentials }) {
     this.url = url;
     this.isHttp = /^https?:/i.test(url);
@@ -273,6 +276,10 @@ class PDFNetworkStreamFullRequestReader {
     const fullRequestXhrId = this._fullRequestId;
     const fullRequestXhr = this._manager.getRequestXhr(fullRequestXhrId);
 
+    this._manager._responseOrigin = getResponseOrigin(
+      fullRequestXhr.responseURL
+    );
+
     const rawResponseHeaders = fullRequestXhr.getAllResponseHeaders();
     const responseHeaders = new Headers(
       rawResponseHeaders
@@ -405,6 +412,7 @@ class PDFNetworkStreamRangeRequestReader {
     this._manager = manager;
 
     const args = {
+      onHeadersReceived: this._onHeadersReceived.bind(this),
       onDone: this._onDone.bind(this),
       onError: this._onError.bind(this),
       onProgress: this._onProgress.bind(this),
@@ -420,6 +428,17 @@ class PDFNetworkStreamRangeRequestReader {
     this.onClosed = null;
   }
 
+  _onHeadersReceived() {
+    const responseOrigin = getResponseOrigin(
+      this._manager.getRequestXhr(this._requestId)?.responseURL
+    );
+    if (responseOrigin !== this._manager._responseOrigin) {
+      this._storedError = new Error(
+        `Expected range response-origin "${responseOrigin}" to match "${this._manager._responseOrigin}".`
+      );
+    }
+  }
+
   _close() {
     this.onClosed?.(this);
   }
@@ -441,7 +460,7 @@ class PDFNetworkStreamRangeRequestReader {
   }
 
   _onError(status) {
-    this._storedError = createResponseStatusError(status, this._url);
+    this._storedError ||= createResponseStatusError(status, this._url);
     for (const requestCapability of this._requests) {
       requestCapability.reject(this._storedError);
     }

src/display/network_utils.js

@@ -36,6 +36,15 @@ function createHeaders(isHttp, httpHeaders) {
   return headers;
 }
 
+function getResponseOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    // `new URL()` will throw on incorrect data.
+  }
+  return null;
+}
+
 function validateRangeRequestCapabilities({
   responseHeaders,
   isHttp,
@@ -116,6 +125,7 @@ export {
   createHeaders,
   createResponseStatusError,
   extractFilenameFromHeader,
+  getResponseOrigin,
   validateRangeRequestCapabilities,
   validateResponseStatus,
 };