wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2736 - Part 6: Re-work <script> src attribute.

Browse source 
Use subject principal as triggering principal in <script> "src" attribute.
This commit is contained in:
Moonchild 2025-04-29 09:47:42 +02:00 • committed by roytam1
commit 1f638b22ec
6 changed files with 47 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

29
dom/script/ScriptLoader.cpp
View file

@ -869,6 +869,8 @@ ScriptLoader::StartFetchingModuleAndDependencies(ModuleLoadRequest* aParent,
RefPtr<ModuleLoadRequest> childRequest =
ModuleLoadRequest::CreateStaticImport(aURI, aParent);
childRequest->mTriggeringPrincipal = aParent->mTriggeringPrincipal;
aParent->mImports.AppendElement(childRequest);
RefPtr<GenericPromise> ready = childRequest->mReady.Ensure(__func__);
@ -1329,15 +1331,16 @@ ScriptLoader::StartLoad(ScriptLoadRequest *aRequest, const nsAString &aType,
securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
nsCOMPtr<nsIChannel> channel;
nsresult rv = NS_NewChannel(getter_AddRefs(channel),
aRequest->mURI,
context,
securityFlags,
contentPolicyType,
loadGroup,
prompter,
nsIRequest::LOAD_NORMAL |
nsIChannel::LOAD_CLASSIFY_URI);
nsresult rv = NS_NewChannelWithTriggeringPrincipal(
getter_AddRefs(channel),
aRequest->mURI,
context,
aRequest->mTriggeringPrincipal,
securityFlags,
contentPolicyType,
loadGroup,
prompter,
nsIRequest::LOAD_NORMAL);
NS_ENSURE_SUCCESS(rv, rv);
@ -1638,10 +1641,14 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
}
}
nsCOMPtr<nsIPrincipal> principal = scriptContent->NodePrincipal();
nsCOMPtr<nsIPrincipal> principal = aElement->GetScriptURITriggeringPrincipal();
if (!principal) {
principal = scriptContent->NodePrincipal();
}
request = CreateLoadRequest(scriptKind, scriptURI, aElement, principal,
ourCORSMode, sriMetadata, referrerPolicy);
request->mTriggeringPrincipal = Move(principal);
request->mIsInline = false;
request->SetScriptMode(aElement->GetScriptDeferred(),
aElement->GetScriptAsync());
@ -1764,6 +1771,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
SRIMetadata(), // SRI doesn't apply
referrerPolicy);
request->mIsInline = true;
request->mTriggeringPrincipal = mDocument->NodePrincipal();
request->mLineNo = aElement->GetScriptLineNumber();
// Only the 'async' attribute is heeded on an inline module script and
@ -3077,6 +3085,7 @@ ScriptLoader::PreloadURI(nsIURI *aURI,
mDocument->NodePrincipal(),
Element::StringToCORSMode(aCrossOrigin), sriMetadata,
aReferrerPolicy);
request->mTriggeringPrincipal = mDocument->NodePrincipal();
request->mIsInline = false;
request->SetScriptMode(aDefer, aAsync);
request->SetIsPreloadRequest();