- C++ 38%
- C 22.3%
- JavaScript 18%
- HTML 10.3%
- Python 3.5%
- Other 7.3%
30797d4da8
Potential attack: session supercookie. [Moz Notes](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c5): "The problem is that for unknown header names we store the first one we see and then later we case-insensitively match against that name *globally*. That means you can track if a user agent has already seen a certain header name used (by using a different casing and observing whether it gets normalized). This would allow you to see if a user has used a sensitive service that uses custom header names, or allows you to track a user across sites, by teaching the browser about a certain header case once and then observing if different casings get normalized to that. What we should do instead is only store the casing for a header name for each header list and not globally. That way it only leaks where it's expected (and necessary) to leak." [Moz fix note](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c8): "nsHttpAtom now holds the old nsHttpAtom and a string that is case sensitive (only for not standard headers). So nsHttpAtom holds a pointer to a header name. (header names are store on a static structure). This is how it used to be. I left that part the same but added a nsCString which holds a string that was used to resoled the header name. So when we parse headers we call ResolveHeader with a char*. If it is a new header name the char* will be stored in a HttpHeapAtom, nsHttpAtom::_val will point to HttpHeapAtom::value and the same strings will be stored in mLocalCaseSensitiveHeader. For the first resolve request they will be the same but for the following maybe not. At the end this nsHttpAtom will be stored in nsHttpHeaderArray. For all operation we will used the old char* except when we are returning it to a script using VisitHeaders." |
||
|---|---|---|
| accessible | ||
| application | ||
| build | ||
| caps | ||
| chrome | ||
| config | ||
| db/sqlite3 | ||
| devtools | ||
| docs | ||
| docshell | ||
| dom | ||
| editor | ||
| embedding | ||
| extensions | ||
| gfx | ||
| gradle/wrapper | ||
| hal | ||
| image | ||
| intl | ||
| ipc | ||
| js | ||
| layout | ||
| media | ||
| memory | ||
| mfbt | ||
| mobile | ||
| modules | ||
| mozglue | ||
| netwerk | ||
| nsprpub | ||
| other-licenses | ||
| parser | ||
| probes | ||
| python | ||
| rdf | ||
| security | ||
| services | ||
| startupcache | ||
| storage | ||
| taskcluster | ||
| testing | ||
| toolkit | ||
| tools | ||
| uriloader | ||
| view | ||
| widget | ||
| xpcom | ||
| xpfe | ||
| .clang-format | ||
| .clang-format-ignore | ||
| .eslintignore | ||
| .eslintrc.js | ||
| .flake8 | ||
| .gdbinit | ||
| .gdbinit_python | ||
| .gitignore | ||
| .lldbinit | ||
| .taskcluster.yml | ||
| .ycm_extra_conf.py | ||
| aclocal.m4 | ||
| Android.mk | ||
| AUTHORS | ||
| build.gradle | ||
| client.mk | ||
| client.py | ||
| CLOBBER | ||
| configure.in | ||
| configure.py | ||
| GNUmakefile | ||
| gradle.properties | ||
| gradlew | ||
| LEGAL | ||
| LICENSE | ||
| mach | ||
| Makefile.in | ||
| moz.build | ||
| moz.configure | ||
| mozilla-config.h.in | ||
| old-configure.in | ||
| README.md | ||
| settings.gradle | ||
| sourcestamp.txt | ||
| test.mozbuild | ||
Unified XUL Platform (UXP)
This repository holds the code for a unified application platform for XUL-based applications. It is a hard fork from the Mozilla code repository (mozilla-central) with an ESR-52 fork point.
In addition to further development based on the Mozilla upstream code, and selective cherry-picking of directly-applicable patches, this repository has its own development and holds the base for a future platform to be used by XUL applications.
This repository will contain at least one application to demonstrate and make use of the platform: The Basilisk web browser, a close twin to Mozilla's Firefox.
Additional documentation
Additional documentation relevant to this source code can be found in the /docs
directory. This will contain relevant documentation regarding contributing,
using and distributing this code and its binaries.
If you are interested in the development and building side of things, some information will be available on the Pale Moon developer wiki.
A note about trademarks and branding
Although this repository is licensed under Mozilla Public License v2.0, the trademarks and brands contained herein remain the property of their respective owners. For more details, please see the notifications in the respective directories.
Foundation and maintainership
This repository has been founded and is maintained by Moonchild (M.C. Straver). If you fork this repository to perform your own work on it, please consider offering improvement patches upstream to its origin to mutually improve the platform and build a future for XUL.