wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#226: Consider blocking top level window data: URIs (part 2/2 without tests)

Browse source 
https://github.com/MoonchildProductions/moebius/pull/226
This commit is contained in:
janekptacijarabaci 2018-04-22 19:03:22 +02:00 • committed by Roy Tam
commit 73f89fe562
16 changed files with 194 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docshell/base/nsDSURIContentListener.cpp
View file

@ -17,6 +17,7 @@
#include "nsIHttpChannel.h"
#include "nsIScriptSecurityManager.h"
#include "nsError.h"
#include "nsContentSecurityManager.h"
#include "nsCharSeparatedTokenizer.h"
#include "nsIConsoleService.h"
#include "nsIScriptError.h"
@ -93,6 +94,14 @@ nsDSURIContentListener::DoContent(const nsACString& aContentType,
if (aOpenedChannel) {
aOpenedChannel->GetLoadFlags(&loadFlags);
// block top-level data URI navigations if triggered by the web
if (!nsContentSecurityManager::AllowTopLevelNavigationToDataURI(aOpenedChannel)) {
// logging to console happens within AllowTopLevelNavigationToDataURI
aRequest->Cancel(NS_ERROR_DOM_BAD_URI);
*aAbortProcess = true;
return NS_OK;
}
}
if (loadFlags & nsIChannel::LOAD_RETARGETED_DOCUMENT_URI) {

10
docshell/base/nsDocShell.cpp
View file

@ -9885,15 +9885,6 @@ nsDocShell::InternalLoad(nsIURI* aURI,
contentType = nsIContentPolicy::TYPE_DOCUMENT;
}
if (!nsContentSecurityManager::AllowTopLevelNavigationToDataURI(
aURI,
contentType,
aTriggeringPrincipal,
(aLoadType == LOAD_NORMAL_EXTERNAL))) {
// logging to console happens within AllowTopLevelNavigationToDataURI
return NS_OK;
}
// If there's no targetDocShell, that means we are about to create a new window,
// perform a content policy check before creating the window.
if (!targetDocShell) {
@ -10962,6 +10953,7 @@ nsDocShell::DoURILoad(nsIURI* aURI,
if (aPrincipalToInherit) {
loadInfo->SetPrincipalToInherit(aPrincipalToInherit);
}
loadInfo->SetLoadTriggeredFromExternal(aLoadFromExternal);
// We have to do this in case our OriginAttributes are different from the
// OriginAttributes of the parent document. Or in case there isn't a