wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-05 06:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity
6,109 commits 7 branches 18 tags 579 MiB
Commit graph

289 commits

Author SHA1 Message Date
Moonchild
7d978ccd71 Issue #2641 - Update Fetch to adhere to the updated spec (pass refpolicy) 
Resolves #2641
 2024-10-24 07:37:31 +08:00
FranklinDM
2d60c54926 Issue #2578 - Part 2: Implement preference for disabling CORS preflight requests if CORS is disabled 2024-09-13 10:03:53 +08:00
Moonchild
dd4e060135 Issue #2554 - Follow-up: Also block [::] and [::0.0.0.0] IPv6 addresses. 2024-08-15 09:39:33 +08:00
Moonchild
fad481b612 Issue #2554 - Follow-up: Correct code comment (no functional changes) 2024-08-15 09:39:06 +08:00
Moonchild
d44b309966 Issue #2554 - Block access to 0.0.0.0 on non-Windows OSes. 
Resolves #2554.
 2024-08-15 09:38:35 +08:00
Moonchild
9759098329 [network] Add additional cookie setting checks. 
Added checks for sub-document navigations from cross-site to same-site in
third-party checks when setting a cookie.
 2024-07-10 14:54:46 +08:00
Moonchild
d9ff917f15 Issue #2542 - Part 9: Remove TODO comment. 
From our understanding of the spec, our current implementation is
feature-complete.
 2024-07-10 14:49:39 +08:00
Moonchild
fffe6c4996 Issue #2542 - Part 7: Move SecFetch.* to /netwerk where it belongs. 2024-07-10 14:49:06 +08:00
Moonchild
8076de8965 Issue #2542 - Part 2: Base implementation of Sec-Fetch-* header code. 
Currently following Mozilla putting stuff in /dom for additional porting,
but it's actually the wrong location since it belongs in /netwerk with
the other code that deals with http headers.
 2024-07-10 14:45:39 +08:00
Moonchild
bcdf7dc845 [network] Avoid accessing raw pointers in nsTransportEventSinkProxy. 2024-06-12 15:12:37 +08:00
Moonchild
bfb171c783 [network] Perform a case-insensitive match on special cookie prefixes. 2024-06-12 15:11:50 +08:00
Moonchild
f3413e94b9 [network] Make http digest auth cnonce length configurable. 2024-05-22 15:20:46 +08:00
Moonchild
1ddd3ea76b [network] Keep track of and check HTTP/2 header sizes. 2024-04-19 09:34:14 +08:00
FranklinDM
656ee639c5 Issue #2112 - Part 1: Remove Stylo tests 2024-04-02 22:29:48 +08:00
Moonchild
9d320dac80 [network] Block set-cookie from multipart/x-mixed-replace 2024-02-23 10:53:04 +08:00
Moonchild
79b4c36ef8 Issue #2451 - Send referrer headers with CORS preflight requests. 
This is dependent on referrer policy.

Fixes #2451
 2024-01-18 10:04:42 +08:00
Brian Smith
811bcbefd4 Issue #2402 - Optionally strictly enforce the MIME type of scripts loaded by importScripts(). https://bugzilla.mozilla.org/show_bug.cgi?id=1514680 This is default on in Firefox 67 but Moonchild requested it be set off by default. 2024-01-11 09:46:39 +08:00
Martok
c451531d54 Issue #2430 - No longer force tcp send buffer size on HTTP/2 uploads > 128KB 
With connection-level and stream-level flow control, it is not needed.
On fast connections with large-ish BWP, this can improve upload speed by > 5x
 2024-01-05 10:11:19 +08:00
Martok
3e65ae353a Issue #2430 - Allow network.http.spdy.chunk-size to be larger than 16K 
According to https://datatracker.ietf.org/doc/html/rfc7540#section-4.2    The size of a frame payload is limited by the maximum size that a
    receiver advertises in the SETTINGS_MAX_FRAME_SIZE setting. This
    setting can have any value between 2^14 (16,384) and 2^24-1
    (16,777,215) octets, inclusive.
 2024-01-05 10:10:50 +08:00
Kershaw Chang
600142110d Bug 1736385 - Make sure thread is alive in CacheIOThread::ThreadFunc 2023-12-21 10:18:53 +08:00
Moonchild
f96001ba7c No issue - Allow redirects for requests that require preflight 
Spec update, see Bug 1312864
 2023-12-15 09:07:32 +08:00
Moonchild
d55111c4fd [Network] Fix relative URL path starting with multiple slashes 2023-11-24 17:05:20 +08:00
Moonchild
38f8fde3e3 [network] Block more invalid cookie name characters. 
This blocks the following characters from use in the cookie name:
0x3B (semi-colon), 0x3D (equals) and 0x7F (del)
 2023-10-26 10:51:50 +08:00
Moonchild
50ad087351 Issue #1721 - Implement GlobalPrivacyControl 
(and get rid of failed DoNotTrack)
 2023-10-18 10:17:23 +08:00
Moonchild
0315aeee73 Issue #1721 - Follow-up: Properly protect GPC header 
Make it a singleton so it cannot be overwritten.
 2023-10-18 09:54:42 +08:00
Basilisk-Dev
21c624222f Issue #2058 - add patches from dbsoft to fix Mac and FreeBSD builds 2023-09-29 09:41:03 +08:00
Basilisk-Dev
0e0bd83fe2 Issue #2058 - apply additional patches from dbsoft for OS defines 2023-09-29 09:28:49 +08:00
Basilisk-Dev
81d8af6565 Issue #2058 - Apply patches from dbsoft to fix Mac and FreeBSD builds 2023-09-29 09:28:21 +08:00
Basilisk-Dev
cc42e14a23 Issue #2058 - Fix build issues in DataChannel.cpp after sctp upgrade 2023-09-29 09:27:53 +08:00
Basilisk-Dev
de80c8a019 Issue #2058 - Initial update of usrsctp library 2023-09-29 09:23:42 +08:00
Moonchild
fb38f6d74e [network] Refactor TransactionObserver::OnDataAvailable() 2023-09-28 11:51:24 +08:00
Moonchild
613cd8f4cb [network] Hold a strong ref to mChannel in OpenConn 2023-08-31 22:42:16 +08:00
Moonchild
058e936f62 [network] Add locking around access to WebSocketChannel::mPMCECompressor 2023-08-31 22:41:14 +08:00
Moonchild
96d1e2766f [network] Prepare for requiring Authorization in CORS ACAH preflight 
The Authorization header with a JSON Web Token (JWT) can be sent via
XMLHttpRequest without explicit authorization via Access-Control headers.
According to the spec, this must always explicitly be mentioned in ACAH
request headers and isn't allowed to be wildcarded. However, nobody
currently obeys this rule and many websites are misconfigured because
Chromium and Firefox always allowed it.

This patch adds the more stricter code but keeps it behind an #ifdef 0
to be released later on if and when there is enough consensus on the web
to obey this spec. This patch explicitly avoids the added complexity
Mozilla added to educate web devs since our role in that respect is not
significant. it's not preffed and it won't throw an explicit deprecation
warning.

See Mozilla bugs 1687364 and 1841019.
 2023-07-06 10:25:09 +08:00
Job Bautista
51ea0e4f3a Issue #1769 - Part 2: Implement JPEG-XL decoder and about:config and MIME plumbing. 
Backported from Mozilla bug 1707590 whereever possible.
 2023-06-24 12:16:27 +08:00
Moonchild
a39fd9e75f Issue #1656 - Remove more vim control lines. 
Vim control lines were re-introduced or not entirely cleaned up.
This nukes them again.
Removing from modules, netwerk, security, storage, testing, toolkit, and
a few scattered misc files. More to come.
 2023-05-05 22:59:16 +08:00
Brian Smith
1109559a5d Issue #1691 - Part 8: Fix --enable-debug builds and continue dynamic module import changes. https://bugzilla.mozilla.org/show_bug.cgi?id=1342012 Support import from timeout handlers by associating the initiating script with the compiled JSScript. Fix error message that covers all import() failures that don't throw a JS exception. https://bugzilla.mozilla.org/show_bug.cgi?id=1331662 Partial - Replace nsJSUtils::EvaluateString calls by ExecutionContext scopes. Left EvaluateString() in nsXBLProtoImplField.cpp until ExecutionContext errors can be fixed. 
(cherry picked from commit 22fcfc77971a9bb204df664c474681f4dcf54211)
 2023-04-30 21:21:06 +08:00
Moonchild
c9d9616334 [network] Improve checks while parsing MIME parameters. 2023-04-13 09:23:30 +08:00
Moonchild
dc4bf9b823 Issue #2180 - Add pref to control NSS TLS 1.3 protocol downgrade sentinel 2023-03-29 11:05:16 +08:00
Moonchild
ca93d4b42d Issue #1831 - Add an option to enable TLS 1.3 "compatibility" mode. 
Critical note: this potentially reduces the strength of TLS 1.3 and
should only be enabled if absolutely necessary to access a site.
A browser restart is required for the pref change to take effect as it
is set on NSS initialization.

Resolves #1831
 2023-03-29 11:04:44 +08:00
Moonchild
525b4e1888 [network] Avoid queue manipulation inside a loop 2023-01-19 09:40:35 +08:00
Martok
a6a420259c Issue #2073 - m-c 1546500: Avoid dispatching synchronous thread shutdown runnables 2023-01-10 07:31:26 +08:00
Moonchild
c95a802078 Issue #2070 - When multiple HSTS headers are received, only consider the first. 
This implements a plain interpretations of RFC 6797, which says to only consider
the first HSTS header.
This slightly conflicts with RFC 7230, which says that sending multiple headers
which can't be merged is illegal (except for a specific whitelist which HSTS isn't in),
so this situation should never occur in the first place (and would therefore not need
the explicit entry in RFC 6797).

It improves HSTS robustness dealing with non-compliant servers.

Resolves #2070
 2022-12-30 09:21:48 +08:00
Moonchild
f54f007d47 [network] Align cookie checks with RFC 6265 (bis) 2022-12-16 11:25:15 +08:00
Moonchild
6a1e540412 [network] move some generic websocket code to the baseclass 2022-12-16 11:24:17 +08:00
Moonchild
6408291d76 [network] Fix Mac buffer overflow. 2022-11-25 11:43:19 +08:00
Moonchild
7fab5ebd11 WebSocketChannel::CleanupConnection should run on the socket thread 2022-11-25 11:42:30 +08:00
Moonchild
37f0199c79 [Network, DOM] Align our implementation with the current CORS/Fetch spec. 2022-11-25 11:41:52 +08:00
Moonchild
0a079c2b90 Issue #2024 - Part 2: Add wildcard to Access-Control-Allow-{Method|Headers} 
For requests without credentials, add wildcard to Access-Control-Allow-Headers
and Access-Control-Allow-Method.

Resolves #2024
 2022-11-10 14:54:54 +08:00
Moonchild
1868e88741 Fix some debug assertions. 
refactored code porting in assertions causing debug build failures.
 2022-10-06 10:26:38 +08:00