wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 16:58:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Avoid drag-and-drop of javascript: URIs

Browse source
This commit is contained in:
wolfbeast 2018-02-05 13:07:58 +01:00 • committed by Roy Tam
commit d49f17dcbc
2 changed files with 34 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
browser/base/content/browser.js
View file

@ -5688,7 +5688,7 @@ function middleMousePaste(event) {
function stripUnsafeProtocolOnPaste(pasteData) {
// Don't allow pasting javascript URIs since we don't support
// LOAD_FLAGS_DISALLOW_INHERIT_PRINCIPAL for those.
return pasteData.replace(/^(?:\s*javascript:)+/i, "");
return pasteData.replace(/\r?\n/g, "").replace(/^(?:\s*javascript:)+/i, "");
}
// handleDroppedLink has the following 2 overloads:

53
browser/base/content/urlbarBindings.xml
View file

@ -701,38 +701,51 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
]]></body>
</method>
<method name="onDragOver">
<parameter name="aEvent"/>
<body>
var types = aEvent.dataTransfer.types;
if (types.includes("application/x-moz-file") ||
types.includes("text/x-moz-url") ||
types.includes("text/uri-list") ||
types.includes("text/unicode"))
aEvent.preventDefault();
</body>
</method>
<method name="onDrop">
<method name="_getDroppableLink">
<parameter name="aEvent"/>
<body><![CDATA[
let links = browserDragAndDrop.dropLinks(aEvent);
// The URL bar automatically handles inputs with newline characters,
// so we can get away with treating text/x-moz-url flavours as text/plain.
if (links.length > 0 && links[0].url) {
let url = links[0].url;
aEvent.preventDefault();
this.value = url;
SetPageProxyState("invalid");
this.focus();
let url = links[0].url;
let strippedURL = stripUnsafeProtocolOnPaste(url);
if (strippedURL != url) {
aEvent.stopImmediatePropagation();
return null;
}
try {
urlSecurityCheck(url,
gBrowser.contentPrincipal,
Ci.nsIScriptSecurityManager.DISALLOW_INHERIT_PRINCIPAL);
} catch (ex) {
return;
return null;
}
return url;
}
return null;
]]></body>
</method>
<method name="onDragOver">
<parameter name="aEvent"/>
<body><![CDATA[
// We don't need the link here, so we ignore the return value.
if (!this._getDroppableLink(aEvent)) {
aEvent.dataTransfer.dropEffect = "none";
}
]]></body>
</method>
<method name="onDrop">
<parameter name="aEvent"/>
<body><![CDATA[
let url = this._getDroppableLink(aEvent);
if (url) {
this.value = url;
SetPageProxyState("invalid");
this.focus();
this.handleCommand();
// Force not showing the dropped URI immediately.
gBrowser.userTypedValue = null;
@ -932,7 +945,7 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
// Unfortunately we're not allowed to set the bits being pasted
// so cancel this event:
aEvent.preventDefault();
aEvent.stopPropagation();
aEvent.stopImmediatePropagation();
this.inputField.value = oldStart + pasteData + oldEnd;
// Fix up cursor/selection: