wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-07 16:28:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1329288: Allow content policy consumers to identify contentPolicy checks from docshell

Browse source
This commit is contained in:
janekptacijarabaci 2018-04-22 20:38:02 +02:00 • committed by Roy Tam
commit 9e52126f1a
3 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docshell/base/nsDocShell.cpp
View file

@ -139,6 +139,7 @@
#include "nsISiteSecurityService.h"
#include "nsStructuredCloneContainer.h"
#include "nsIStructuredCloneContainer.h"
#include "nsISupportsPrimitives.h"
#ifdef MOZ_PLACES
#include "nsIFaviconService.h"
#include "mozIPlacesPendingOperation.h"
@ -9931,13 +9932,24 @@ nsDocShell::InternalLoad(nsIURI* aURI,
#endif
}
// Since Content Policy checks are performed within docShell as well as
// the ContentSecurityManager we need a reliable way to let certain
// nsIContentPolicy consumers ignore duplicate calls. Let's use the 'extra'
// argument to pass a specific identifier.
nsCOMPtr<nsISupportsString> extraStr =
do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID, &rv);
NS_ENSURE_SUCCESS(rv, rv);
NS_NAMED_LITERAL_STRING(msg, "conPolCheckFromDocShell");
rv = extraStr->SetData(msg);
NS_ENSURE_SUCCESS(rv, rv);
int16_t shouldLoad = nsIContentPolicy::ACCEPT;
rv = NS_CheckContentLoadPolicy(contentType,
aURI,
aTriggeringPrincipal,
requestingContext,
EmptyCString(), // mime guess
nullptr, // extra
extraStr, // extra
&shouldLoad);
if (NS_FAILED(rv) || NS_CP_REJECTED(shouldLoad)) {

5
dom/security/nsCSPContext.cpp
View file

@ -171,9 +171,10 @@ nsCSPContext::ShouldLoad(nsContentPolicyType aContentType,
}
}
// aExtra is only non-null if the channel got redirected.
bool wasRedirected = (aExtra != nullptr);
// aExtra holds the original URI of the channel if the
// channel got redirected (until we fix Bug 1332422).
nsCOMPtr<nsIURI> originalURI = do_QueryInterface(aExtra);
bool wasRedirected = originalURI;
bool permitted = permitsInternal(dir,
aContentLocation,

10
toolkit/modules/addons/WebRequestContent.js
View file

@ -80,6 +80,16 @@ var ContentPolicy = {
shouldLoad(policyType, contentLocation, requestOrigin,
node, mimeTypeGuess, extra, requestPrincipal) {
// Loads of TYPE_DOCUMENT and TYPE_SUBDOCUMENT perform a ConPol check
// within docshell as well as within the ContentSecurityManager. To avoid
// duplicate evaluations we ignore ConPol checks performed within docShell.
if (extra instanceof Ci.nsISupportsString) {
if (extra.data === "conPolCheckFromDocShell") {
return Ci.nsIContentPolicy.ACCEPT;
}
}
if (requestPrincipal &&
Services.scriptSecurityManager.isSystemPrincipal(requestPrincipal)) {
return Ci.nsIContentPolicy.ACCEPT;