wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2914 - Explicitly allow mixed content websockets on localhost.

Browse source 
This carves out an exception for hard-coded loopback addresses to allow
`ws:` connections from `https:` to allow mixed-mode from secure pages.

Resolves #2914
This commit is contained in:
Moonchild 2026-01-23 23:09:58 +01:00 • committed by OwnedByWuigi
commit aee2800d48
3 changed files with 19 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

23
dom/security/nsMixedContentBlocker.cpp
View file

@ -334,16 +334,23 @@ nsMixedContentBlocker::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
return NS_OK;
}
bool nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL(nsIURI* aURL) {
nsAutoCString host;
nsresult rv = aURL->GetHost(host);
NS_ENSURE_SUCCESS(rv, false);
return host.EqualsLiteral("127.0.0.1") || host.EqualsLiteral("::1") ||
host.EqualsLiteral("localhost");
bool
nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackHost(const nsACString& aAsciiHost) {
return aAsciiHost.EqualsLiteral("127.0.0.1") ||
aAsciiHost.EqualsLiteral("::1") ||
aAsciiHost.EqualsLiteral("localhost");
}
bool nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin(nsIURI* aURI) {
bool
nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL(nsIURI* aURL) {
nsAutoCString asciiHost;
nsresult rv = aURL->GetAsciiHost(asciiHost);
NS_ENSURE_SUCCESS(rv, false);
return IsPotentiallyTrustworthyLoopbackHost(asciiHost);
}
bool
nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin(nsIURI* aURI) {
// The following implements:
// https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy