wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-03 14:28:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

[PALEMOON] [frontend vs backend] Implemented "originPrincipal" and "triggeringPrincipal"

Browse source 
Issue #679
Follow up #311
This commit is contained in:
janekptacijarabaci 2018-07-28 10:06:53 +02:00 • committed by Roy Tam
commit d2aa8d3853
4 changed files with 102 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
application/palemoon/base/content/browser.js
View file

@ -1051,6 +1051,8 @@ var gBrowserInit = {
// [3]: postData (nsIInputStream)
// [4]: allowThirdPartyFixup (bool)
// [5]: referrerPolicy (int)
// [6]: originPrincipal (nsIPrincipal)
// [7]: triggeringPrincipal (nsIPrincipal)
else if (window.arguments.length >= 3) {
let referrerURI = window.arguments[2];
if (typeof(referrerURI) == "string") {
@ -1063,7 +1065,10 @@ var gBrowserInit = {
let referrerPolicy = (window.arguments[5] != undefined ?
window.arguments[5] : Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT);
loadURI(uriToLoad, referrerURI, window.arguments[3] || null,
window.arguments[4] || false, referrerPolicy);
window.arguments[4] || false, referrerPolicy,
// pass the origin principal (if any) and force its use to create
// an initial about:blank viewer if present:
window.arguments[6], !!window.arguments[6], window.arguments[7]);
window.focus();
}
// Note: loadOneOrMoreURIs *must not* be called if window.arguments.length >= 3.
@ -1952,7 +1957,9 @@ function BrowserTryToCloseWindow()
window.close(); // WindowIsClosing does all the necessary checks
}
function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy) {
function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
originPrincipal, forceAboutBlankViewerInCurrent,
triggeringPrincipal) {
if (postData === undefined)
postData = null;
@ -1968,6 +1975,9 @@ function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy)
referrerURI: referrer,
referrerPolicy: referrerPolicy,
postData: postData,
originPrincipal: originPrincipal,
triggeringPrincipal: triggeringPrincipal,
forceAboutBlankViewerInCurrent: forceAboutBlankViewerInCurrent,
});
} catch (e) {}
}
@ -4395,9 +4405,11 @@ nsBrowserAccess.prototype = {
}
let referrer = aOpener ? makeURI(aOpener.location.href) : null;
let triggeringPrincipal = null;
let referrerPolicy = Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT;
if (aOpener && aOpener.document) {
referrerPolicy = aOpener.document.referrerPolicy;
triggeringPrincipal = aOpener.document.nodePrincipal;
}
switch (aWhere) {
@ -4437,6 +4449,7 @@ nsBrowserAccess.prototype = {
let referrer = aOpener ? makeURI(aOpener.location.href) : null;
let tab = win.gBrowser.loadOneTab(aURI ? aURI.spec : "about:blank", {
triggeringPrincipal: triggeringPrincipal,
referrerURI: referrer,
referrerPolicy: referrerPolicy,
fromExternal: isExternal,
@ -4459,6 +4472,7 @@ nsBrowserAccess.prototype = {
Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
gBrowser.loadURIWithFlags(aURI.spec, {
flags: loadflags,
triggeringPrincipal: triggeringPrincipal,
referrerURI: referrer,
referrerPolicy: referrerPolicy,
});
@ -5192,7 +5206,9 @@ function handleLinkClick(event, href, linkNode) {
urlSecurityCheck(href, doc.nodePrincipal);
openLinkIn(href, where, { referrerURI: doc.documentURIObject,
charset: doc.characterSet,
referrerPolicy: doc.referrerPolicy });
referrerPolicy: doc.referrerPolicy,
originPrincipal: doc.nodePrincipal,
triggeringPrincipal: doc.nodePrincipal });
event.preventDefault();
return true;
}

14
application/palemoon/base/content/nsContextMenu.js
View file

@ -754,7 +754,9 @@ nsContextMenu.prototype = {
openLinkIn(this.linkURL, "window",
{ charset: doc.characterSet,
referrerURI: doc.documentURIObject,
referrerPolicy: doc.referrerPolicy });
referrerPolicy: doc.referrerPolicy,
originPrincipal: doc.nodePrincipal,
triggeringPrincipal: doc.nodePrincipal });
},
// Open linked-to URL in a new private window.
@ -765,6 +767,8 @@ nsContextMenu.prototype = {
{ charset: doc.characterSet,
referrerURI: doc.documentURIObject,
referrerPolicy: doc.referrerPolicy,
originPrincipal: doc.nodePrincipal,
triggeringPrincipal: doc.nodePrincipal,
private: true });
},
@ -775,7 +779,9 @@ nsContextMenu.prototype = {
openLinkIn(this.linkURL, "tab",
{ charset: doc.characterSet,
referrerURI: doc.documentURIObject,
referrerPolicy: doc.referrerPolicy });
referrerPolicy: doc.referrerPolicy,
originPrincipal: doc.nodePrincipal,
triggeringPrincipal: doc.nodePrincipal });
},
// open URL in current tab
@ -784,7 +790,9 @@ nsContextMenu.prototype = {
urlSecurityCheck(this.linkURL, doc.nodePrincipal);
openLinkIn(this.linkURL, "current",
{ charset: doc.characterSet,
referrerURI: doc.documentURIObject });
referrerURI: doc.documentURIObject,
originPrincipal: doc.nodePrincipal,
triggeringPrincipal: doc.nodePrincipal });
},
// Open frame in a new tab.

26
application/palemoon/base/content/tabbrowser.xml
View file

@ -1313,13 +1313,16 @@
<parameter name="aAllowThirdPartyFixup"/>
<body>
<![CDATA[
var aTriggeringPrincipal;
var aReferrerPolicy;
var aFromExternal;
var aRelatedToCurrent;
var aOriginPrincipal;
if (arguments.length == 2 &&
typeof arguments[1] == "object" &&
!(arguments[1] instanceof Ci.nsIURI)) {
let params = arguments[1];
aTriggeringPrincipal = params.triggeringPrincipal;
aReferrerURI = params.referrerURI;
aReferrerPolicy = params.referrerPolicy;
aCharset = params.charset;
@ -1328,12 +1331,14 @@
aAllowThirdPartyFixup = params.allowThirdPartyFixup;
aFromExternal = params.fromExternal;
aRelatedToCurrent = params.relatedToCurrent;
aOriginPrincipal = params.originPrincipal;
}
var bgLoad = (aLoadInBackground != null) ? aLoadInBackground :
Services.prefs.getBoolPref("browser.tabs.loadInBackground");
var owner = bgLoad ? null : this.selectedTab;
var tab = this.addTab(aURI, {
triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aReferrerURI,
referrerPolicy: aReferrerPolicy,
charset: aCharset,
@ -1341,6 +1346,7 @@
ownerTab: owner,
allowThirdPartyFixup: aAllowThirdPartyFixup,
fromExternal: aFromExternal,
originPrincipal: aOriginPrincipal,
relatedToCurrent: aRelatedToCurrent});
if (!bgLoad)
this.selectedTab = tab;
@ -1461,14 +1467,17 @@
<body>
<![CDATA[
const NS_XUL = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var aTriggeringPrincipal;
var aReferrerPolicy;
var aFromExternal;
var aRelatedToCurrent;
var aSkipAnimation;
var aOriginPrincipal;
if (arguments.length == 2 &&
typeof arguments[1] == "object" &&
!(arguments[1] instanceof Ci.nsIURI)) {
let params = arguments[1];
aTriggeringPrincipal = params.triggeringPrincipal;
aReferrerURI = params.referrerURI;
aReferrerPolicy = params.referrerPolicy;
aCharset = params.charset;
@ -1478,6 +1487,7 @@
aFromExternal = params.fromExternal;
aRelatedToCurrent = params.relatedToCurrent;
aSkipAnimation = params.skipAnimation;
aOriginPrincipal = params.originPrincipal;
}
// if we're adding tabs, we're past interrupt mode, ditch the owner
@ -1486,6 +1496,11 @@
var t = document.createElementNS(NS_XUL, "tab");
let aURIObject = null;
try {
aURIObject = Services.io.newURI(aURI || "about:blank");
} catch (ex) { /* we'll try to fix up this URL later */ }
var uriIsAboutBlank = !aURI || aURI == "about:blank";
if (!aURI || isBlankPageURL(aURI))
@ -1625,6 +1640,16 @@
evt.initEvent("TabOpen", true, false);
t.dispatchEvent(evt);
if (aOriginPrincipal && aURI) {
let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
// Unless we know for sure we're not inheriting principals,
// force the about:blank viewer to have the right principal:
if (!aURIObject ||
(Services.io.getProtocolFlags(aURIObject.scheme) & URI_INHERITS_SECURITY_CONTEXT)) {
b.createAboutBlankContentViewer(aOriginPrincipal);
}
}
// If we didn't swap docShells with a preloaded browser
// then let's just continue loading the page normally.
if (!docShellsSwapped && !uriIsAboutBlank) {
@ -1643,6 +1668,7 @@
try {
b.loadURIWithFlags(aURI, {
flags: flags,
triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aReferrerURI,
referrerPolicy: aReferrerPolicy,
charset: aCharset,

49
application/palemoon/base/content/utilityOverlay.js
View file

@ -230,6 +230,10 @@ function openLinkIn(url, where, params) {
var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
var aInitiatingDoc = params.initiatingDoc;
var aIsPrivate = params.private;
var aPrincipal = params.originPrincipal;
var aTriggeringPrincipal = params.triggeringPrincipal;
var aForceAboutBlankViewerInCurrent =
params.forceAboutBlankViewerInCurrent;
var sendReferrerURI = true;
if (where == "save") {
@ -254,6 +258,23 @@ function openLinkIn(url, where, params) {
// Note that if |w| is null we might have no current browser (we'll open a new window).
var aCurrentBrowser = params.currentBrowser || (w && w.gBrowser.selectedBrowser);
// Teach the principal about the right OA to use, e.g. in case when
// opening a link in a new private window.
// Please note we do not have to do that for SystemPrincipals and we
// can not do it for NullPrincipals since NullPrincipals are only
// identical if they actually are the same object (See Bug: 1346759)
function useOAForPrincipal(principal) {
if (principal && principal.isCodebasePrincipal) {
let attrs = {
privateBrowsingId: aIsPrivate || (w && PrivateBrowsingUtils.isWindowPrivate(w)),
};
return Services.scriptSecurityManager.createCodebasePrincipal(principal.URI, attrs);
}
return principal;
}
aPrincipal = useOAForPrincipal(aPrincipal);
aTriggeringPrincipal = useOAForPrincipal(aTriggeringPrincipal);
if (!w || where == "window") {
// This propagates to window.arguments.
// Strip referrer data when opening a new private window, to prevent
@ -297,6 +318,8 @@ function openLinkIn(url, where, params) {
sa.AppendElement(aPostData);
sa.AppendElement(allowThirdPartyFixupSupports);
sa.AppendElement(referrerPolicySupports);
sa.AppendElement(aPrincipal);
sa.AppendElement(aTriggeringPrincipal);
let features = "chrome,dialog=no,all";
if (aIsPrivate) {
@ -314,10 +337,17 @@ function openLinkIn(url, where, params) {
getBoolPref("browser.tabs.loadInBackground");
}
let uriObj;
if (where == "current") {
try {
uriObj = Services.io.newURI(url, null, null);
} catch (e) {}
}
if (where == "current" && w.gBrowser.selectedTab.pinned) {
try {
let uriObj = Services.io.newURI(url, null, null);
if (!uriObj.schemeIs("javascript") &&
// nsIURI.host can throw for non-nsStandardURL nsIURIs.
if (!uriObj || !uriObj.schemeIs("javascript") &&
w.gBrowser.currentURI.host != uriObj.host) {
where = "tab";
loadInBackground = false;
@ -345,11 +375,22 @@ function openLinkIn(url, where, params) {
if (aForceAllowDataURI) {
flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
}
let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
if (aForceAboutBlankViewerInCurrent &&
(!uriObj ||
(Services.io.getProtocolFlags(uriObj.scheme) & URI_INHERITS_SECURITY_CONTEXT))) {
// Unless we know for sure we're not inheriting principals,
// force the about:blank viewer to have the right principal:
w.gBrowser.selectedBrowser.createAboutBlankContentViewer(aPrincipal);
}
w.gBrowser.loadURIWithFlags(url, {
flags: flags,
triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aReferrerURI,
referrerPolicy: aReferrerPolicy,
postData: aPostData,
originPrincipal: aPrincipal,
});
browserUsedForLoad = aCurrentBrowser;
break;
@ -365,7 +406,9 @@ function openLinkIn(url, where, params) {
postData: aPostData,
inBackground: loadInBackground,
allowThirdPartyFixup: aAllowThirdPartyFixup,
relatedToCurrent: aRelatedToCurrent});
relatedToCurrent: aRelatedToCurrent,
originPrincipal: aPrincipal,
triggeringPrincipal: aTriggeringPrincipal });
browserUsedForLoad = tabUsedForLoad.linkedBrowser;
break;
}