Trying to do a positive check on nested URIs apparently doesn't work,
but the handling could be simplified to just check for non-null mURI
instead - this also fixes plugin loading (which broke with the previous
check).
If a website would nor supply a URI for object loading code, the browser
would crash on a null deref.
This reintroduces the nestedURI check to make sure we have a valid URI.
According to the W3C discussion we should allow websocket URIs to be
reported aside from http/https/ftp ones.
This rewrites things slightly and updates comments to clarify.
We do retain the non-standard reduction to origin only in case the
report is for cross-origin URIs (stops leaking full URIs to the CSP
reported destination).
See https://github.com/w3c/webappsec-csp/issues/735
Youtube's usage patterns have changed regarding video embeds, so we can
remove special handling for the enablejsapi flag.
Applies YouTube embed URL replacement to the path component only.
Per spec, extend escaping of attribute value characters to include
`<` and `>`. We already did this for text fragments, and it makes sense
to apply the same to attribute values. We are at parity with mainstream
that default-escape attribute values this way in current releases.
This changes Rotate{Self}(angle, translateX, translateY) to
Rotate{Self}(rotateX, rotateY, rotateZ) per the spec.
The resulting matrix will be a 3DMatrix
Resolves#2752
This interface inly has a single implementation behind it, which is also
only used in 2 places after the previous commit. That's a lot of
additional complexity and compiler indirection for no good reason.
This change removes the interface and uses direct nsDocShell::Cast calls
instead of going through the interface in the few places left now that
we no longer build on a presentation context for links.
This removes the requirement for there to be a non-null PresShell to
dispatch `Click()` events on `<A>` elements (only), since the exception
to the rule has propagated to the spec.
With these changes it should now be possible do create an anchor and
`Click()` on it from JS without actually first attaching it to the DOM
of the presented document, as abused by scripted downloads in pages
(instead of using the A attribute to custom-name downloads).
In `OnStreamCompleteInternal` an incorrect workerthread CSP enabled check
was added. This was a duplicate check and this is actually on the main
thread so asserts the wrong thread for a `WorkerPref`.
Per the CSP specification, content injected by extensions is meant to
be exempt from page CSP. This patch takes care of the most common case
of content injected by extension content scripts, which always have
expanded principals which inherit from the page principal.
To make this easier, de-virtualize BasePrincipal::Kind(), using CTOR
initializers instead.
