wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-10 10:18:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#226: Consider blocking top level window data: URIs (part 2/2 without tests)

Browse source 
https://github.com/MoonchildProductions/moebius/pull/226
This commit is contained in:
janekptacijarabaci 2018-04-22 19:03:22 +02:00 • committed by Roy Tam
commit 73f89fe562
16 changed files with 194 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

6
dom/security/test/general/browser.ini
View file

@ -3,3 +3,9 @@
support-files =
file_toplevel_data_navigations.sjs
file_toplevel_data_meta_redirect.html
[browser_test_data_download.js]
support-files =
file_data_download.html
[browser_test_data_text_csv.js]
support-files =
file_data_text_csv.html

37
dom/security/test/general/browser_test_data_download.js Normal file
View file

@ -0,0 +1,37 @@
"use strict";
const kTestPath = getRootDirectory(gTestPath)
.replace("chrome://mochitests/content", "http://example.com")
const kTestURI = kTestPath + "file_data_download.html";
function addWindowListener(aURL, aCallback) {
Services.wm.addListener({
onOpenWindow(aXULWindow) {
info("window opened, waiting for focus");
Services.wm.removeListener(this);
var domwindow = aXULWindow.QueryInterface(Ci.nsIInterfaceRequestor)
.getInterface(Ci.nsIDOMWindow);
waitForFocus(function() {
is(domwindow.document.location.href, aURL, "should have seen the right window open");
aCallback(domwindow);
}, domwindow);
},
onCloseWindow(aXULWindow) { },
onWindowTitleChange(aXULWindow, aNewTitle) { }
});
}
function test() {
waitForExplicitFinish();
Services.prefs.setBoolPref("security.data_uri.block_toplevel_data_uri_navigations", true);
registerCleanupFunction(function() {
Services.prefs.clearUserPref("security.data_uri.block_toplevel_data_uri_navigations");
});
addWindowListener("chrome://mozapps/content/downloads/unknownContentType.xul", function(win) {
is(win.document.getElementById("location").value, "data-foo.html",
"file name of download should match");
win.close();
finish();
});
gBrowser.loadURI(kTestURI);
}

37
dom/security/test/general/browser_test_data_text_csv.js Normal file
View file

@ -0,0 +1,37 @@
"use strict";
const kTestPath = getRootDirectory(gTestPath)
.replace("chrome://mochitests/content", "http://example.com")
const kTestURI = kTestPath + "file_data_text_csv.html";
function addWindowListener(aURL, aCallback) {
Services.wm.addListener({
onOpenWindow(aXULWindow) {
info("window opened, waiting for focus");
Services.wm.removeListener(this);
var domwindow = aXULWindow.QueryInterface(Ci.nsIInterfaceRequestor)
.getInterface(Ci.nsIDOMWindow);
waitForFocus(function() {
is(domwindow.document.location.href, aURL, "should have seen the right window open");
aCallback(domwindow);
}, domwindow);
},
onCloseWindow(aXULWindow) { },
onWindowTitleChange(aXULWindow, aNewTitle) { }
});
}
function test() {
waitForExplicitFinish();
Services.prefs.setBoolPref("security.data_uri.block_toplevel_data_uri_navigations", true);
registerCleanupFunction(function() {
Services.prefs.clearUserPref("security.data_uri.block_toplevel_data_uri_navigations");
});
addWindowListener("chrome://mozapps/content/downloads/unknownContentType.xul", function(win) {
is(win.document.getElementById("location").value, "text/csv;foo,bar,foobar",
"file name of download should match");
win.close();
finish();
});
gBrowser.loadURI(kTestURI);
}

14
dom/security/test/general/file_data_download.html Normal file
View file

@ -0,0 +1,14 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Test download attribute for data: URI</title>
</head>
<body>
<a href="data:text/html,<body>data download</body>" download="data-foo.html" id="testlink">download data</a>
<script>
// click the link to have the downoad panel appear
let testlink = document.getElementById("testlink");
testlink.click();
</script>
</body>
</html>

14
dom/security/test/general/file_data_text_csv.html Normal file
View file

@ -0,0 +1,14 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Test open data:text/csv</title>
</head>
<body>
<a href="data:text/csv;foo,bar,foobar" id="testlink">test text/csv</a>
<script>
// click the link to have the downoad panel appear
let testlink = document.getElementById("testlink");
testlink.click();
</script>
</body>
</html>

18
dom/security/test/general/test_block_toplevel_data_img_navigation.html
View file

@ -34,15 +34,17 @@ function test_toplevel_data_image_svg() {
const DATA_SVG =
"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDE2IDE2Ij4KICA8cGF0aCBkPSJNOCwxMkwzLDcsNCw2bDQsNCw0LTQsMSwxWiIgZmlsbD0iIzZBNkE2QSIgLz4KPC9zdmc+Cg==";
let win2 = window.open(DATA_SVG);
let wrappedWin2 = SpecialPowers.wrap(win2);
setTimeout(function () {
isnot(wrappedWin2.document.documentElement.localName, "svg",
"Loading data:image/svg+xml should be blocked");
wrappedWin2.close();
SimpleTest.finish();
}, 1000);
// Unfortunately we can't detect whether the window was closed using some event,
// hence we are constantly polling till we see that win == null.
// Test times out on failure.
var win2Closed = setInterval(function() {
if (win2 == null || win2.closed) {
clearInterval(win2Closed);
ok(true, "Loading data:image/svg+xml should be blocked");
SimpleTest.finish();
}
}, 200);
}
// fire up the tests
test_toplevel_data_image();

16
dom/security/test/general/test_block_toplevel_data_navigation.html
View file

@ -21,16 +21,12 @@ function test1() {
// simple data: URI click navigation should be prevented
let TEST_FILE = "file_block_toplevel_data_navigation.html";
let win1 = window.open(TEST_FILE);
var readyStateCheckInterval = setInterval(function() {
let state = win1.document.readyState;
if (state === "interactive" || state === "complete") {
clearInterval(readyStateCheckInterval);
ok(win1.document.body.innerHTML.indexOf("test1:") !== -1,
"toplevel data: URI navigation through click() should be blocked");
win1.close();
test2();
}
}, 200);
setTimeout(function () {
ok(SpecialPowers.wrap(win1).document.body.innerHTML.indexOf("test1:") !== -1,
"toplevel data: URI navigation through click() should be blocked");
win1.close();
test2();
}, 1000);
}
function test2() {