From 7e02267fd34887c435fc2c2880eb49c322839b30 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Mon, 19 Apr 2021 20:47:29 +0000 Subject: [PATCH 1/5] [DOM] Add missing IDL definitions for CSP .nonce attributes. Apparently Mozilla completely spaced out on this when adding the CSP nonce mechanism, potentially causing web compat issues if scripting relies on being able to get/set nonces through DOM and/or causing CSP policy check issues if websites try to "hide" nonces. --- dom/html/HTMLLinkElement.h | 8 ++++++++ dom/html/HTMLScriptElement.h | 8 ++++++++ dom/html/HTMLStyleElement.h | 8 ++++++++ dom/webidl/HTMLLinkElement.webidl | 2 ++ dom/webidl/HTMLScriptElement.webidl | 10 ++++------ dom/webidl/HTMLStyleElement.webidl | 2 ++ 6 files changed, 32 insertions(+), 6 deletions(-) diff --git a/dom/html/HTMLLinkElement.h b/dom/html/HTMLLinkElement.h index 8575d5b49f..aca16d56a4 100644 --- a/dom/html/HTMLLinkElement.h +++ b/dom/html/HTMLLinkElement.h @@ -109,6 +109,14 @@ public: SetHTMLAttr(nsGkAtoms::rel, aRel, aRv); } nsDOMTokenList* RelList(); + void GetNonce(nsAString& aNonce) const + { + GetHTMLAttr(nsGkAtoms::nonce, aNonce); + } + void SetNonce(const nsAString& aNonce, ErrorResult& aRv) + { + SetHTMLAttr(nsGkAtoms::nonce, aNonce, aRv); + } // XPCOM GetMedia is fine. void SetMedia(const nsAString& aMedia, ErrorResult& aRv) { diff --git a/dom/html/HTMLScriptElement.h b/dom/html/HTMLScriptElement.h index a0c9e47258..a80f0262a1 100644 --- a/dom/html/HTMLScriptElement.h +++ b/dom/html/HTMLScriptElement.h @@ -80,6 +80,14 @@ public: { SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError); } + void GetNonce(nsAString& aNonce) const + { + GetHTMLAttr(nsGkAtoms::nonce, aNonce); + } + void SetNonce(const nsAString& aNonce, ErrorResult& aRv) + { + SetHTMLAttr(nsGkAtoms::nonce, aNonce, aRv); + } void GetIntegrity(nsAString& aIntegrity) { GetHTMLAttr(nsGkAtoms::integrity, aIntegrity); diff --git a/dom/html/HTMLStyleElement.h b/dom/html/HTMLStyleElement.h index 60331dc5df..585047ba38 100644 --- a/dom/html/HTMLStyleElement.h +++ b/dom/html/HTMLStyleElement.h @@ -60,6 +60,14 @@ public: bool Disabled() const; void SetDisabled(bool aDisabled); + void GetNonce(nsAString& aNonce) const + { + GetHTMLAttr(nsGkAtoms::nonce, aNonce); + } + void SetNonce(const nsAString& aNonce, ErrorResult& aRv) + { + SetHTMLAttr(nsGkAtoms::nonce, aNonce, aRv); + } void SetMedia(const nsAString& aMedia, ErrorResult& aError) { SetHTMLAttr(nsGkAtoms::media, aMedia, aError); diff --git a/dom/webidl/HTMLLinkElement.webidl b/dom/webidl/HTMLLinkElement.webidl index 4fa40d04d0..0089ab84e6 100644 --- a/dom/webidl/HTMLLinkElement.webidl +++ b/dom/webidl/HTMLLinkElement.webidl @@ -26,6 +26,8 @@ interface HTMLLinkElement : HTMLElement { readonly attribute DOMTokenList relList; [CEReactions, SetterThrows, Pure] attribute DOMString media; + [CEReactions, SetterThrows, Pure] + attribute DOMString nonce; [CEReactions, SetterThrows, Pure] attribute DOMString hreflang; [CEReactions, SetterThrows, Pure] diff --git a/dom/webidl/HTMLScriptElement.webidl b/dom/webidl/HTMLScriptElement.webidl index 286c0673d8..6b48a52443 100644 --- a/dom/webidl/HTMLScriptElement.webidl +++ b/dom/webidl/HTMLScriptElement.webidl @@ -26,6 +26,10 @@ interface HTMLScriptElement : HTMLElement { attribute DOMString? crossOrigin; [CEReactions, SetterThrows] attribute DOMString text; + [CEReactions, SetterThrows, Pure] + attribute DOMString nonce; + [CEReactions, SetterThrows, Pure] + attribute DOMString integrity; }; // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis @@ -35,9 +39,3 @@ partial interface HTMLScriptElement { [CEReactions, SetterThrows] attribute DOMString htmlFor; }; - -// https://w3c.github.io/webappsec/specs/subresourceintegrity/#htmlscriptelement-1 -partial interface HTMLScriptElement { - [CEReactions, SetterThrows] - attribute DOMString integrity; -}; diff --git a/dom/webidl/HTMLStyleElement.webidl b/dom/webidl/HTMLStyleElement.webidl index 3cacbf62fd..3f2e0c8630 100644 --- a/dom/webidl/HTMLStyleElement.webidl +++ b/dom/webidl/HTMLStyleElement.webidl @@ -15,6 +15,8 @@ interface HTMLStyleElement : HTMLElement { [CEReactions, SetterThrows, Pure] attribute DOMString media; [CEReactions, SetterThrows, Pure] + attribute DOMString nonce; + [CEReactions, SetterThrows, Pure] attribute DOMString type; [SetterThrows, Pure] attribute boolean scoped; From 88bfb5d5d169386e1048f40f6512f7a6e4c3f31b Mon Sep 17 00:00:00 2001 From: Jeff Gilbert Date: Tue, 20 Apr 2021 12:46:56 +0000 Subject: [PATCH 2/5] [WebGL] Bind framebuffer before DrawBuffers/ReadBuffer selection. --- dom/canvas/WebGLFramebuffer.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dom/canvas/WebGLFramebuffer.cpp b/dom/canvas/WebGLFramebuffer.cpp index 7a1d4dbd9e..cbba648bd1 100644 --- a/dom/canvas/WebGLFramebuffer.cpp +++ b/dom/canvas/WebGLFramebuffer.cpp @@ -1216,6 +1216,7 @@ WebGLFramebuffer::RefreshDrawBuffers() const } } + gl->fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER, mGLName); gl->fDrawBuffers(driverBuffers.size(), driverBuffers.data()); } @@ -1235,6 +1236,7 @@ WebGLFramebuffer::RefreshReadBuffer() const driverBuffer = mColorReadBuffer->mAttachmentPoint; } + gl->fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER, mGLName); gl->fReadBuffer(driverBuffer); } From 69597507dbb7e09887808499fad98ef7fe23ca29 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 20 Apr 2021 13:12:38 +0000 Subject: [PATCH 3/5] [Network] Solve type mismatch in AllowPort(). Casting it to an int16_t was wrong and would preclude the check for high port numbers (due to overflow). This makes the type matching, but adds an explicit check to ensure the port number passed in is within a valid range. --- netwerk/base/nsIOService.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp index a953dc78c1..55f40a41ef 100644 --- a/netwerk/base/nsIOService.cpp +++ b/netwerk/base/nsIOService.cpp @@ -1203,13 +1203,14 @@ nsIOService::SetConnectivityInternal(bool aConnectivity) NS_IMETHODIMP nsIOService::AllowPort(int32_t inPort, const char *scheme, bool *_retval) { - int16_t port = inPort; + int32_t port = inPort; if (port == -1) { *_retval = true; return NS_OK; } - if (port == 0) { + // Ensure the port number is within a valid range + if (port <= 0 || port >= std::numeric_limits::max()) { *_retval = false; return NS_OK; } From d846ef7beef06cd22b57137d78d75f0b1a6092b3 Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Wed, 21 Apr 2021 11:29:09 +0800 Subject: [PATCH 4/5] [Pale-Moon] Issue #1701 - Allow Open All in Tabs for containers with only one child URI --- application/palemoon/components/places/content/controller.js | 2 +- application/palemoon/components/places/content/sidebarUtils.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/application/palemoon/components/places/content/controller.js b/application/palemoon/components/places/content/controller.js index 1c8eeee514..33312330f5 100644 --- a/application/palemoon/components/places/content/controller.js +++ b/application/palemoon/components/places/content/controller.js @@ -633,7 +633,7 @@ PlacesController.prototype = { if (!openContainerInTabsItem.hidden) { var containerToUse = this._view.selectedNode || this._view.result.root; if (PlacesUtils.nodeIsContainer(containerToUse)) { - if (!PlacesUtils.hasChildURIs(containerToUse, true)) { + if (!PlacesUtils.hasChildURIs(containerToUse)) { openContainerInTabsItem.disabled = true; // Ensure that we don't display the menu if nothing is enabled: usableItemCount--; diff --git a/application/palemoon/components/places/content/sidebarUtils.js b/application/palemoon/components/places/content/sidebarUtils.js index 9a2660bd67..66ea103777 100644 --- a/application/palemoon/components/places/content/sidebarUtils.js +++ b/application/palemoon/components/places/content/sidebarUtils.js @@ -36,7 +36,7 @@ var SidebarUtils = { var openInTabs = isContainer && (aEvent.button == 1 || (aEvent.button == 0 && modifKey)) && - PlacesUtils.hasChildURIs(tbo.view.nodeForTreeIndex(cell.row), true); + PlacesUtils.hasChildURIs(tbo.view.nodeForTreeIndex(cell.row)); if (aEvent.button == 0 && isContainer && !openInTabs) { tbo.view.toggleOpenState(cell.row); From 8d7f0a27aa0b2f152410e440882f79bcd8d2387a Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Wed, 21 Apr 2021 11:40:20 +0800 Subject: [PATCH 5/5] [Pale-Moon] Issue #1816 - Warn before opening many URI nodes in tabs --- application/palemoon/components/places/PlacesUIUtils.jsm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/application/palemoon/components/places/PlacesUIUtils.jsm b/application/palemoon/components/places/PlacesUIUtils.jsm index f15886c639..8a7d4a00f1 100644 --- a/application/palemoon/components/places/PlacesUIUtils.jsm +++ b/application/palemoon/components/places/PlacesUIUtils.jsm @@ -759,7 +759,9 @@ this.PlacesUIUtils = { if (PlacesUtils.nodeIsURI(aNodes[i])) urlsToOpen.push({uri: aNodes[i].uri, isBookmark: PlacesUtils.nodeIsBookmark(aNodes[i])}); } - this._openTabset(urlsToOpen, aEvent, window); + if (this._confirmOpenInTabs(urlsToOpen.length, window)) { + this._openTabset(urlsToOpen, aEvent, window); + } }, /**