wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 00:38:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

WIP fix 1

Browse source
This commit is contained in:
wolfbeast 2019-02-28 10:02:19 +01:00 • committed by Roy Tam
commit 54df9f8a30
4 changed files with 42 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

5
application/palemoon/base/content/browser.js
View file

@ -2661,6 +2661,11 @@ function getWebNavigation()
}
function BrowserReloadWithFlags(reloadFlags) {
// Reset DOS mitigation for auth prompts when user initiates a reload.
let browser = gBrowser.selectedBrowser;
delete browser.authPromptCounter;
/* First, we'll try to use the session history object to reload so
* that framesets are handled properly. If we're in a special
* window (such as view-source) that has no session history, fall

5
application/palemoon/base/content/tabbrowser.xml
View file

@ -2458,7 +2458,10 @@
<parameter name="aTab"/>
<body>
<![CDATA[
this.getBrowserForTab(aTab).reload();
let browser = this.getBrowserForTab(aTab);
// Reset DOS mitigation for basic auth prompt
delete browser.authPromptCounter;
browser.reload();
]]>
</body>
</method>

4
application/palemoon/base/content/urlbarBindings.xml
View file

@ -302,6 +302,10 @@
// but don't let that interfere with the loading of the url.
Cu.reportError(ex);
}
// Reset DOS mitigations for the basic auth prompt.
let browser = gBrowser.selectedBrowser;
delete browser.authPromptCounter;
function loadCurrent() {
let flags = Ci.nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;

48
toolkit/components/passwordmgr/nsLoginManagerPrompter.js
View file

@ -97,17 +97,25 @@ LoginManagerPromptFactory.prototype = {
return;
}
// Allow only a limited number of authentication dialogs when they are all
// canceled by the user.
var cancelationCounter = (prompter._browser && prompter._browser.canceledAuthenticationPromptCounter) || { count: 0, id: 0 };
if (prompt.channel) {
var httpChannel = prompt.channel.QueryInterface(Ci.nsIHttpChannel);
if (httpChannel) {
var windowId = httpChannel.topLevelContentWindowId;
if (windowId != cancelationCounter.id) {
// window has been reloaded or navigated, reset the counter
cancelationCounter = { count: 0, id: windowId };
}
// Set up a counter for ensuring that the basic auth prompt can not
// be abused for DOS-style attacks. With this counter, each eTLD+1
// per browser will get a limited number of times a user can
// cancel the prompt until we stop showing it.
let browser = prompter._browser;
let baseDomain = null;
if (browser) {
try {
baseDomain = Services.eTLD.getBaseDomainFromHost(hostname);
} catch (e) {
baseDomain = hostname;
}
if (!browser.authPromptCounter) {
browser.authPromptCounter = {};
}
if (!browser.authPromptCounter[baseDomain]) {
browser.authPromptCounter[baseDomain] = 0;
}
}
@ -137,13 +145,14 @@ LoginManagerPromptFactory.prototype = {
prompt.inProgress = false;
self._asyncPromptInProgress = false;
if (ok) {
cancelationCounter.count = 0;
} else {
cancelationCounter.count++;
}
if (prompter._browser) {
prompter._browser.canceledAuthenticationPromptCounter = cancelationCounter;
if (browser) {
// Reset the counter state if the user replied to a prompt and actually
// tried to login (vs. simply clicking any button to get out).
if (ok && (prompt.authInfo.username || prompt.authInfo.password)) {
browser.authPromptCounter[baseDomain] = 0;
} else {
browser.authPromptCounter[baseDomain] += 1;
}
}
}
@ -168,8 +177,9 @@ LoginManagerPromptFactory.prototype = {
var cancelDialogLimit = Services.prefs.getIntPref("prompts.authentication_dialog_abuse_limit");
let cancelationCounter = browser.authPromptCounter[baseDomain];
this.log("cancelationCounter =", cancelationCounter);
if (cancelDialogLimit && cancelationCounter.count >= cancelDialogLimit) {
if (cancelDialogLimit && cancelationCounter >= cancelDialogLimit) {
this.log("Blocking auth dialog, due to exceeding dialog bloat limit");
delete this._asyncPrompts[hashKey];