wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-25 00:27:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

Perform LoadURL checks for WebExtensions.

Browse source
This commit is contained in:
wolfbeast 2018-02-08 11:37:12 +01:00 • committed by Roy Tam
commit c2c3d90841
3 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
browser/components/extensions/ext-browserAction.js
View file

@ -497,6 +497,9 @@ extensions.registerSchemaAPI("browserAction", "addon_parent", context => {
// For internal consistency, we currently resolve both relative to the // For internal consistency, we currently resolve both relative to the
// calling context. // calling context.
let url = details.popup && context.uri.resolve(details.popup); let url = details.popup && context.uri.resolve(details.popup);
if (url && !context.checkLoadURL(url)) {
return Promise.reject({message: `Access denied for URL ${url}`});
}
BrowserAction.for(extension).setProperty(tab, "popup", url); BrowserAction.for(extension).setProperty(tab, "popup", url);
}, },

3
browser/components/extensions/ext-pageAction.js
View file

@ -273,6 +273,9 @@ extensions.registerSchemaAPI("pageAction", "addon_parent", context => {
// For internal consistency, we currently resolve both relative to the // For internal consistency, we currently resolve both relative to the
// calling context. // calling context.
let url = details.popup && context.uri.resolve(details.popup); let url = details.popup && context.uri.resolve(details.popup);
if (url && !context.checkLoadURL(url)) {
return Promise.reject({message: `Access denied for URL ${url}`});
}
PageAction.for(extension).setProperty(tab, "popup", url); PageAction.for(extension).setProperty(tab, "popup", url);
}, },

1
browser/components/extensions/schemas/page_action.json
View file

@ -173,6 +173,7 @@
{ {
"name": "setPopup", "name": "setPopup",
"type": "function", "type": "function",
"async": true,
"description": "Sets the html document to be opened as a popup when the user clicks on the page action's icon.", "description": "Sets the html document to be opened as a popup when the user clicks on the page action's icon.",
"parameters": [ "parameters": [
{ {