wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-07 08:18:41 +09:00
Code Issues Projects Releases Packages Wiki Activity

Update Basilisk FE code with HTTP Auth DoS protection.

Browse source
This commit is contained in:
wolfbeast 2019-02-28 14:16:09 +01:00 • committed by Roy Tam
commit 7b71e22bee
4 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
application/basilisk/app/profile/basilisk.js
View file

@ -1438,3 +1438,11 @@ pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);
// controlling validation are located in /services/sync/services-sync.js
pref("services.sync.validation.enabled", true);
#endif
// When a user cancels this number of authentication dialogs coming from
// a single web page (eTLD+1) in a row, all following authentication dialogs
// will be blocked (automatically canceled) for that page.
// This counter is per-tab and per-domain to minimize false positives.
// The counter resets when the page is reloaded from the UI
// (content-reloads do NOT clear this to mitigate reloading tricks).
pref("prompts.authentication_dialog_abuse_limit", 3);

5
application/basilisk/base/content/browser.js
View file

@ -3099,6 +3099,11 @@ function getWebNavigation()
}
function BrowserReloadWithFlags(reloadFlags) {
// Reset DOS mitigation for auth prompts when user initiates a reload.
let browser = gBrowser.selectedBrowser;
delete browser.authPromptCounter;
let url = gBrowser.currentURI.spec;
if (gBrowser.updateBrowserRemotenessByURL(gBrowser.selectedBrowser, url)) {
// If the remoteness has changed, the new browser doesn't have any

5
application/basilisk/base/content/tabbrowser.xml
View file

@ -3007,7 +3007,10 @@
<parameter name="aTab"/>
<body>
<![CDATA[
this.getBrowserForTab(aTab).reload();
let browser = this.getBrowserForTab(aTab);
// Reset DOS mitigation for basic auth prompt
delete browser.authPromptCounter;
browser.reload();
]]>
</body>
</method>

3
application/basilisk/base/content/urlbarBindings.xml
View file

@ -554,6 +554,9 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
Cu.reportError(ex);
}
// Reset DOS mitigations for the basic auth prompt.
delete browser.authPromptCounter;
let params = {
postData,
allowThirdPartyFixup: true,