[Extensions] Change Mime-Type deducation in URLRequestExtensionJob

Modify URLRequestExtensionJob to determine the mime type of a requested
file through net::GetWellKnownMimeTypeFromExtension(), rather than
URLRequestFileJob::GetMimeType(). The difference here is that the latter
will include platform-specific modifications. This means that if another
application on the users machine specified a different mime type for an
extension, that type would be used.

This causes problems with modules in extensions, in the cases where a
different application has set a different mime type for .js files, since
modules have strict mime type requirements.

Use GetWellKnownMimeTypeFromExtension(), and add .js to the list of
primary mappings in mime_util.cc.

Bug: 797712

Change-Id: I27fea0479268520abd08fb62a501d213a3a04f52
Reviewed-on: https://chromium-review.googlesource.com/885401Reviewed-by: Asanka Herath <asanka@chromium.org>
Commit-Queue: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532070}

extensions/browser/extension_protocols.cc

@@ -72,6 +72,7 @@
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "net/base/filename_util.h"
 #include "net/base/io_buffer.h"
+#include "net/base/mime_util.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
@@ -219,16 +220,6 @@ class URLRequestExtensionJob : public net::URLRequestFileJob {
   }
 
   void GetResponseInfo(net::HttpResponseInfo* info) override {
-    // Set the mime type for the request. We do this here (rather than when we
-    // build the rest of the headers) because the mime type is retrieved only
-    // after URLRequestFileJob::Start() is called. Using an accurate mime type
-    // is necessary at least for modules, which enforce strict mime type
-    // requirements.
-    std::string mime_type;
-    bool found_mime_type = GetMimeType(&mime_type);
-    if (found_mime_type)
-      response_info_.headers->AddHeader("Content-Type: " + mime_type);
-
     *info = response_info_;
   }
 
@@ -328,9 +319,31 @@ class URLRequestExtensionJob : public net::URLRequestFileJob {
         content_security_policy_,
         send_cors_header_,
         *last_modified_time);
+    // Set the mime type for the request.
+    std::string mime_type;
+    bool found_mime_type = GetMimeType(&mime_type);
+    if (found_mime_type)
+      response_info_.headers->AddHeader("Content-Type: " + mime_type);
+
     URLRequestFileJob::Start();
   }
 
+  bool GetMimeType(std::string* mime_type) const override {
+    base::FilePath::StringType file_extension = file_path_.Extension();
+    if (file_extension.empty())
+      return false;
+
+    // We use GetWellKnownMimeTypeFromExtension() to ensure that configurations
+    // that may have been set by other programs on a user's machine don't affect
+    // the mime type returned (in particular, JS should always be
+    // application/javascript). See https://crbug.com/797712. Using an accurate
+    // mime type is necessary at least for modules, which enforce strict mime
+    // type requirements.
+    return net::GetWellKnownMimeTypeFromExtension(
+        file_extension.substr(1),  // Trim leading '.'
+        mime_type);
+  }
+
   scoped_refptr<ContentVerifyJob> verify_job_;
 
   std::unique_ptr<base::ElapsedTimer> request_timer_;

net/base/mime_util.cc

@@ -79,6 +79,7 @@ static const MimeInfo kPrimaryMappings[] = {
     // Must precede audio/webm .
     {"video/webm", "webm"},
 
+    {"application/javascript", "js"},
     {"application/wasm", "wasm"},
     {"application/x-chrome-extension", "crx"},
     {"application/xhtml+xml", "xhtml,xht,xhtm"},
@@ -107,7 +108,6 @@ static const MimeInfo kSecondaryMappings[] = {
     {"application/epub+zip", "epub"},
     {"application/font-woff", "woff"},
     {"application/gzip", "gz,tgz"},
-    {"application/javascript", "js"},
     {"application/octet-stream", "bin,exe,com"},
     {"application/pdf", "pdf"},
     {"application/pkcs7-mime", "p7m,p7c,p7z"},