wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 01:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#230: Consider blocking top level window data: URIs (part 3/3 without tests)

Browse source 
https://github.com/MoonchildProductions/moebius/pull/230
This commit is contained in:
janekptacijarabaci 2018-04-22 20:28:18 +02:00 • committed by Roy Tam
commit 18d312235d
20 changed files with 143 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
application/palemoon/base/content/nsContextMenu.js
View file

@ -909,7 +909,8 @@ nsContextMenu.prototype = {
Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
let doc = this.target.ownerDocument;
openUILink(viewURL, e, { disallowInheritPrincipal: true,
referrerURI: doc.documentURIObject });
referrerURI: doc.documentURIObject,
forceAllowDataURI: true });
}
},

5
application/palemoon/base/content/utilityOverlay.js
View file

@ -205,6 +205,7 @@ function openUILinkIn(url, where, aAllowThirdPartyFixup, aPostData, aReferrerURI
openLinkIn(url, where, params);
}
/* eslint-disable complexity */
function openLinkIn(url, where, params) {
if (!where || !url)
return;
@ -215,6 +216,7 @@ function openLinkIn(url, where, params) {
var aCharset = params.charset;
var aReferrerURI = params.referrerURI;
var aRelatedToCurrent = params.relatedToCurrent;
var aForceAllowDataURI = params.forceAllowDataURI;
var aInBackground = params.inBackground;
var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
var aInitiatingDoc = params.initiatingDoc;
@ -315,6 +317,9 @@ function openLinkIn(url, where, params) {
}
if (aDisallowInheritPrincipal)
flags |= Ci.nsIWebNavigation.LOAD_FLAGS_DISALLOW_INHERIT_OWNER;
if (aForceAllowDataURI) {
flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
}
w.gBrowser.loadURIWithFlags(url, flags, aReferrerURI, null, aPostData);
break;
case "tabshifted":

3
browser/base/content/nsContextMenu.js
View file

@ -1158,7 +1158,8 @@ nsContextMenu.prototype = {
this.browser.contentPrincipal,
Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
openUILink(this.mediaURL, e, { disallowInheritPrincipal: true,
referrerURI: referrerURI });
referrerURI: referrerURI,
forceAllowDataURI: true });
}
},

5
browser/base/content/utilityOverlay.js
View file

@ -197,6 +197,7 @@ function openUILinkIn(url, where, aAllowThirdPartyFixup, aPostData, aReferrerURI
openLinkIn(url, where, params);
}
/* eslint-disable complexity */
function openLinkIn(url, where, params) {
if (!where || !url)
return;
@ -212,6 +213,7 @@ function openLinkIn(url, where, params) {
params.referrerPolicy : Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT);
var aRelatedToCurrent = params.relatedToCurrent;
var aAllowMixedContent = params.allowMixedContent;
var aForceAllowDataURI = params.forceAllowDataURI;
var aInBackground = params.inBackground;
var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
var aInitiatingDoc = params.initiatingDoc;
@ -378,6 +380,9 @@ function openLinkIn(url, where, params) {
if (aIndicateErrorPageLoad) {
flags |= Ci.nsIWebNavigation.LOAD_FLAGS_ERROR_LOAD_CHANGES_RV;
}
if (aForceAllowDataURI) {
flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
}
let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
if (aForceAboutBlankViewerInCurrent &&

17
docshell/base/nsDocShell.cpp
View file

@ -1273,6 +1273,7 @@ nsDocShell::LoadURI(nsIURI* aURI,
nsCOMPtr<nsISHEntry> shEntry;
nsXPIDLString target;
nsAutoString srcdoc;
bool forceAllowDataURI = false;
nsCOMPtr<nsIDocShell> sourceDocShell;
nsCOMPtr<nsIURI> baseURI;
@ -1308,6 +1309,7 @@ nsDocShell::LoadURI(nsIURI* aURI,
aLoadInfo->GetSrcdocData(srcdoc);
aLoadInfo->GetSourceDocShell(getter_AddRefs(sourceDocShell));
aLoadInfo->GetBaseURI(getter_AddRefs(baseURI));
aLoadInfo->GetForceAllowDataURI(&forceAllowDataURI);
}
#if defined(DEBUG)
@ -1561,6 +1563,10 @@ nsDocShell::LoadURI(nsIURI* aURI,
flags |= INTERNAL_LOAD_FLAGS_IS_SRCDOC;
}
if (forceAllowDataURI) {
flags |= INTERNAL_LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
}
return InternalLoad(aURI,
originalURI,
loadReplace,
@ -4822,6 +4828,9 @@ nsDocShell::LoadURIWithOptions(const char16_t* aURI,
}
nsAutoPopupStatePusher statePusher(popupState);
bool forceAllowDataURI =
aLoadFlags & LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
// Don't pass certain flags that aren't needed and end up confusing
// ConvertLoadTypeToDocShellLoadInfo. We do need to ensure that they are
// passed to LoadURI though, since it uses them.
@ -4851,6 +4860,7 @@ nsDocShell::LoadURIWithOptions(const char16_t* aURI,
loadInfo->SetReferrerPolicy(aReferrerPolicy);
loadInfo->SetHeadersStream(aHeaderStream);
loadInfo->SetBaseURI(aBaseURI);
loadInfo->SetForceAllowDataURI(forceAllowDataURI);
if (fixupInfo) {
nsAutoString searchProvider, keyword;
@ -10083,6 +10093,7 @@ nsDocShell::InternalLoad(nsIURI* aURI,
// principal to inherit is: it should be aTriggeringPrincipal.
loadInfo->SetPrincipalIsExplicit(true);
loadInfo->SetLoadType(ConvertLoadTypeToDocShellLoadInfo(LOAD_LINK));
loadInfo->SetForceAllowDataURI(aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_DATA_URI);
rv = win->Open(NS_ConvertUTF8toUTF16(spec),
aWindowTarget, // window name
@ -10728,7 +10739,9 @@ nsDocShell::InternalLoad(nsIURI* aURI,
nsINetworkPredictor::PREDICT_LOAD, this, nullptr);
nsCOMPtr<nsIRequest> req;
rv = DoURILoad(aURI, aOriginalURI, aLoadReplace, loadFromExternal, aReferrer,
rv = DoURILoad(aURI, aOriginalURI, aLoadReplace, loadFromExternal,
(aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_DATA_URI),
aReferrer,
!(aFlags & INTERNAL_LOAD_FLAGS_DONT_SEND_REFERRER),
aReferrerPolicy,
aTriggeringPrincipal, principalToInherit, aTypeHint,
@ -10809,6 +10822,7 @@ nsDocShell::DoURILoad(nsIURI* aURI,
nsIURI* aOriginalURI,
bool aLoadReplace,
bool aLoadFromExternal,
bool aForceAllowDataURI,
nsIURI* aReferrerURI,
bool aSendReferrer,
uint32_t aReferrerPolicy,
@ -10954,6 +10968,7 @@ nsDocShell::DoURILoad(nsIURI* aURI,
loadInfo->SetPrincipalToInherit(aPrincipalToInherit);
}
loadInfo->SetLoadTriggeredFromExternal(aLoadFromExternal);
loadInfo->SetForceAllowDataURI(aForceAllowDataURI);
// We have to do this in case our OriginAttributes are different from the
// OriginAttributes of the parent document. Or in case there isn't a

1
docshell/base/nsDocShell.h
View file

@ -370,6 +370,7 @@ protected:
nsIURI* aOriginalURI,
bool aLoadReplace,
bool aLoadFromExternal,
bool aForceAllowDataURI,
nsIURI* aReferrer,
bool aSendReferrer,
uint32_t aReferrerPolicy,

15
docshell/base/nsDocShellLoadInfo.cpp
View file

@ -15,6 +15,7 @@ nsDocShellLoadInfo::nsDocShellLoadInfo()
: mLoadReplace(false)
, mInheritPrincipal(false)
, mPrincipalIsExplicit(false)
, mForceAllowDataURI(false)
, mSendReferrer(true)
, mReferrerPolicy(mozilla::net::RP_Default)
, mLoadType(nsIDocShellLoadInfo::loadNormal)
@ -126,6 +127,20 @@ nsDocShellLoadInfo::SetPrincipalIsExplicit(bool aPrincipalIsExplicit)
return NS_OK;
}
NS_IMETHODIMP
nsDocShellLoadInfo::GetForceAllowDataURI(bool* aForceAllowDataURI)
{
*aForceAllowDataURI = mForceAllowDataURI;
return NS_OK;
}
NS_IMETHODIMP
nsDocShellLoadInfo::SetForceAllowDataURI(bool aForceAllowDataURI)
{
mForceAllowDataURI = aForceAllowDataURI;
return NS_OK;
}
NS_IMETHODIMP
nsDocShellLoadInfo::GetLoadType(nsDocShellInfoLoadType* aLoadType)
{

1
docshell/base/nsDocShellLoadInfo.h
View file

@ -37,6 +37,7 @@ protected:
bool mLoadReplace;
bool mInheritPrincipal;
bool mPrincipalIsExplicit;
bool mForceAllowDataURI;
bool mSendReferrer;
nsDocShellInfoReferrerPolicy mReferrerPolicy;
nsDocShellInfoLoadType mLoadType;

3
docshell/base/nsIDocShell.idl
View file

@ -116,6 +116,9 @@ interface nsIDocShell : nsIDocShellTreeItem
const long INTERNAL_LOAD_FLAGS_NO_OPENER = 0x100;
// Whether a top-level data URI navigation is allowed for that load
const long INTERNAL_LOAD_FLAGS_FORCE_ALLOW_DATA_URI = 0x200;
// NB: 0x80 is available.
/**

6
docshell/base/nsIDocShellLoadInfo.idl
View file

@ -55,6 +55,12 @@ interface nsIDocShellLoadInfo : nsISupports
*/
attribute boolean principalIsExplicit;
/**
* If this attribute is true, then a top-level navigation
* to a data URI will be allowed.
*/
attribute boolean forceAllowDataURI;
/* these are load type enums... */
const long loadNormal = 0; // Normal Load
const long loadNormalReplace = 1; // Normal Load but replaces current history slot

6
docshell/base/nsIWebNavigation.idl
View file

@ -205,6 +205,12 @@ interface nsIWebNavigation : nsISupports
*/
const unsigned long LOAD_FLAGS_FIXUP_SCHEME_TYPOS = 0x200000;
/**
* Allows a top-level data: navigation to occur. E.g. view-image
* is an explicit user action which should be allowed.
*/
const unsigned long LOAD_FLAGS_FORCE_ALLOW_DATA_URI = 0x400000;
/**
* Loads a given URI. This will give priority to loading the requested URI
* in the object implementing this interface. If it can't be loaded here

4
dom/security/nsContentSecurityManager.cpp
View file

@ -39,6 +39,10 @@ nsContentSecurityManager::AllowTopLevelNavigationToDataURI(nsIChannel* aChannel)
if (loadInfo->GetExternalContentPolicyType() != nsIContentPolicy::TYPE_DOCUMENT) {
return true;
}
if (loadInfo->GetForceAllowDataURI()) {
// if the loadinfo explicitly allows the data URI navigation, let's allow it now
return true;
}
nsCOMPtr<nsIURI> uri;
nsresult rv = NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
NS_ENSURE_SUCCESS(rv, true);

3
dom/security/test/general/browser.ini
View file

@ -9,3 +9,6 @@ support-files =
[browser_test_data_text_csv.js]
support-files =
file_data_text_csv.html
[browser_test_view_image_data_navigation.js]
support-files =
file_view_image_data_navigation.html

30
dom/security/test/general/browser_test_view_image_data_navigation.js Normal file
View file

@ -0,0 +1,30 @@
"use strict";
const TEST_PAGE = getRootDirectory(gTestPath) + "file_view_image_data_navigation.html";
add_task(async function test_principal_right_click_open_link_in_new_tab() {
await SpecialPowers.pushPrefEnv({
"set": [["security.data_uri.block_toplevel_data_uri_navigations", true]],
});
await BrowserTestUtils.withNewTab(TEST_PAGE, async function(browser) {
let loadPromise = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, true);
// simulate right-click->view-image
BrowserTestUtils.waitForEvent(document, "popupshown", false, event => {
// These are operations that must be executed synchronously with the event.
document.getElementById("context-viewimage").doCommand();
event.target.hidePopup();
return true;
});
BrowserTestUtils.synthesizeMouseAtCenter("#testimage",
{ type: "contextmenu", button: 2 },
gBrowser.selectedBrowser);
await loadPromise;
await ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
ok(content.document.location.toString().startsWith("data:image/svg+xml;"),
"data:image/svg navigation allowed through right-click view-image")
});
});
});

12
dom/security/test/general/file_view_image_data_navigation.html Normal file
View file

@ -0,0 +1,12 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1407891: Test navigation for right-click view-image on data:image/svg</title>
</head>
<body>
<img id="testimage" src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDE2IDE2Ij4KICA8cGF0aCBkPSJNOCwxMkwzLDcsNCw2bDQsNCw0LTQsMSwxWiIgZmlsbD0iIzZBNkE2QSIgLz4KPC9zdmc+Cg=="></img>
</body>
</html>

2
ipc/glue/BackgroundUtils.cpp
View file

@ -280,6 +280,7 @@ LoadInfoToLoadInfoArgs(nsILoadInfo *aLoadInfo,
aLoadInfo->GetUpgradeInsecureRequests(),
aLoadInfo->GetVerifySignedContent(),
aLoadInfo->GetEnforceSRI(),
aLoadInfo->GetForceAllowDataURI(),
aLoadInfo->GetForceInheritPrincipalDropped(),
aLoadInfo->GetInnerWindowID(),
aLoadInfo->GetOuterWindowID(),
@ -357,6 +358,7 @@ LoadInfoArgsToLoadInfo(const OptionalLoadInfoArgs& aOptionalLoadInfoArgs,
loadInfoArgs.upgradeInsecureRequests(),
loadInfoArgs.verifySignedContent(),
loadInfoArgs.enforceSRI(),
loadInfoArgs.forceAllowDataURI(),
loadInfoArgs.forceInheritPrincipalDropped(),
loadInfoArgs.innerWindowID(),
loadInfoArgs.outerWindowID(),

22
netwerk/base/LoadInfo.cpp
View file

@ -54,6 +54,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
, mUpgradeInsecureRequests(false)
, mVerifySignedContent(false)
, mEnforceSRI(false)
, mForceAllowDataURI(false)
, mForceInheritPrincipalDropped(false)
, mInnerWindowID(0)
, mOuterWindowID(0)
@ -227,6 +228,7 @@ LoadInfo::LoadInfo(nsPIDOMWindowOuter* aOuterWindow,
, mUpgradeInsecureRequests(false)
, mVerifySignedContent(false)
, mEnforceSRI(false)
, mForceAllowDataURI(false)
, mForceInheritPrincipalDropped(false)
, mInnerWindowID(0)
, mOuterWindowID(0)
@ -285,6 +287,7 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
, mUpgradeInsecureRequests(rhs.mUpgradeInsecureRequests)
, mVerifySignedContent(rhs.mVerifySignedContent)
, mEnforceSRI(rhs.mEnforceSRI)
, mForceAllowDataURI(rhs.mForceAllowDataURI)
, mForceInheritPrincipalDropped(rhs.mForceInheritPrincipalDropped)
, mInnerWindowID(rhs.mInnerWindowID)
, mOuterWindowID(rhs.mOuterWindowID)
@ -315,6 +318,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
bool aUpgradeInsecureRequests,
bool aVerifySignedContent,
bool aEnforceSRI,
bool aForceAllowDataURI,
bool aForceInheritPrincipalDropped,
uint64_t aInnerWindowID,
uint64_t aOuterWindowID,
@ -341,6 +345,7 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
, mUpgradeInsecureRequests(aUpgradeInsecureRequests)
, mVerifySignedContent(aVerifySignedContent)
, mEnforceSRI(aEnforceSRI)
, mForceAllowDataURI(aForceAllowDataURI)
, mForceInheritPrincipalDropped(aForceInheritPrincipalDropped)
, mInnerWindowID(aInnerWindowID)
, mOuterWindowID(aOuterWindowID)
@ -653,6 +658,23 @@ LoadInfo::GetEnforceSRI(bool* aResult)
return NS_OK;
}
NS_IMETHODIMP
LoadInfo::SetForceAllowDataURI(bool aForceAllowDataURI)
{
MOZ_ASSERT(!mForceAllowDataURI ||
mInternalContentPolicyType == nsIContentPolicy::TYPE_DOCUMENT,
"can only allow data URI navigation for TYPE_DOCUMENT");
mForceAllowDataURI = aForceAllowDataURI;
return NS_OK;
}
NS_IMETHODIMP
LoadInfo::GetForceAllowDataURI(bool* aForceAllowDataURI)
{
*aForceAllowDataURI = mForceAllowDataURI;
return NS_OK;
}
NS_IMETHODIMP
LoadInfo::GetForceInheritPrincipalDropped(bool* aResult)
{

2
netwerk/base/LoadInfo.h
View file

@ -94,6 +94,7 @@ private:
bool aUpgradeInsecureRequests,
bool aVerifySignedContent,
bool aEnforceSRI,
bool aForceAllowDataURI,
bool aForceInheritPrincipalDropped,
uint64_t aInnerWindowID,
uint64_t aOuterWindowID,
@ -139,6 +140,7 @@ private:
bool mUpgradeInsecureRequests;
bool mVerifySignedContent;
bool mEnforceSRI;
bool mForceAllowDataURI;
bool mForceInheritPrincipalDropped;
uint64_t mInnerWindowID;
uint64_t mOuterWindowID;

5
netwerk/base/nsILoadInfo.idl
View file

@ -469,6 +469,11 @@ interface nsILoadInfo : nsISupports
*/
[infallible] attribute boolean enforceSRI;
/**
* If true, toplevel data: URI navigation is allowed
*/
[infallible] attribute boolean forceAllowDataURI;
/**
* The SEC_FORCE_INHERIT_PRINCIPAL flag may be dropped when a load info
* object is created. Specifically, it will be dropped if the SEC_SANDBOXED

1
netwerk/ipc/NeckoChannelParams.ipdlh
View file

@ -39,6 +39,7 @@ struct LoadInfoArgs
bool upgradeInsecureRequests;
bool verifySignedContent;
bool enforceSRI;
bool forceAllowDataURI;
bool forceInheritPrincipalDropped;
uint64_t innerWindowID;
uint64_t outerWindowID;