wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 23:38:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

[DOM] Don't allow internal MIME types to be assigned to DataTransfer

Browse source 
We already blocked x-moz-file(-promise) and x-moz-place* but of course people
would find ways to abuse other internal types. This change now blocks everything
except x-moz-url types which are harmless. (i.e. whitelist instead of blacklist)
This commit is contained in:
Moonchild 2022-02-10 22:21:40 +00:00 • committed by roytam1
commit 3bcd2ee360
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
widget/nsITransferable.idl
View file

@ -13,12 +13,17 @@ interface nsIPrincipal;
%{ C++
// Internal formats must have their second part starting with 'x-moz-',
// for example text/x-moz-internaltype. These cannot be assigned by
// unprivileged content but all other types can.
#define kInternal_Mimetype_Prefix "/x-moz-"
// these probably shouldn't live here, but in some central repository shared
// by the entire app.
#define kTextMime "text/plain"
#define kRTFMime "text/rtf"
#define kUnicodeMime "text/unicode"
#define kMozTextInternal "text/x-moz-text-internal" // text data which isn't suppoed to be parsed by other apps.
#define kMozTextInternal "text/x-moz-text-internal" // text data which isn't suppoed to be parsed by other apps.
#define kHTMLMime "text/html"
#define kAOLMailMime "AOLMAIL"
#define kPNGImageMime "image/png"