wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-03 06:18:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Revert "Bug 1182569 - Skip security check for plugins using newstream attribute"

Browse source 
This reverts commit 5b0f4649b3fee771379af60ec04d43b8a525cf80.
This commit is contained in:
janekptacijarabaci 2018-04-22 22:16:58 +02:00 • committed by Roy Tam
commit ca1f03fbae
5 changed files with 24 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

25
dom/plugins/base/nsPluginInstanceOwner.cpp
View file

@ -535,6 +535,16 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL,
nsresult rv = NS_NewURI(getter_AddRefs(uri), aURL, baseURI);
NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
if (aDoCheckLoadURIChecks) {
nsCOMPtr<nsIScriptSecurityManager> secMan(
do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv));
NS_ENSURE_TRUE(secMan, NS_ERROR_FAILURE);
rv = secMan->CheckLoadURIWithPrincipal(content->NodePrincipal(), uri,
nsIScriptSecurityManager::STANDARD);
NS_ENSURE_SUCCESS(rv, rv);
}
nsCOMPtr<nsIInputStream> headersDataStream;
if (aPostStream && aHeadersData) {
if (!aHeadersDataLen)
@ -553,21 +563,8 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL,
Preferences::GetInt("privacy.popups.disable_from_plugins");
nsAutoPopupStatePusher popupStatePusher((PopupControlState)blockPopups);
// if security checks (in particular CheckLoadURIWithPrincipal) needs
// to be skipped we are creating a codebasePrincipal to make sure
// that security check succeeds. Please note that we do not want to
// fall back to using the systemPrincipal, because that would also
// bypass ContentPolicy checks which should still be enforced.
nsCOMPtr<nsIPrincipal> triggeringPrincipal;
if (!aDoCheckLoadURIChecks) {
mozilla::PrincipalOriginAttributes attrs =
BasePrincipal::Cast(content->NodePrincipal())->OriginAttributesRef();
triggeringPrincipal = BasePrincipal::CreateCodebasePrincipal(uri, attrs);
}
rv = lh->OnLinkClick(content, uri, unitarget.get(), NullString(),
aPostStream, headersDataStream, true, triggeringPrincipal);
aPostStream, headersDataStream, true);
return rv;
}