Bug 1499918 - Strip URLs reported to the console by the anti-tracking module of any username/password r=baku

Differential Revision: https://phabricator.services.mozilla.com/D9055

--HG--
extra : moz-landing-system : lando

toolkit/components/antitracking/AntiTrackingCommon.cpp

@@ -27,6 +27,7 @@
 #include "nsIPrincipal.h"
 #include "nsIScriptError.h"
 #include "nsIURI.h"
+#include "nsIURIFixup.h"
 #include "nsIURL.h"
 #include "nsIWebProgressListener.h"
 #include "nsNetUtil.h"
@@ -259,7 +260,15 @@ ReportBlockingToConsole(nsPIDOMWindowOuter* aWindow, nsIURI* aURI,
 
   MOZ_ASSERT(message);
 
-  NS_ConvertUTF8toUTF16 spec(aURI->GetSpecOrDefault());
+  // Strip the URL of any possible username/password and make it ready to be
+  // presented in the UI.
+  nsCOMPtr<nsIURIFixup> urifixup = services::GetURIFixup();
+  NS_ENSURE_TRUE_VOID(urifixup);
+  nsCOMPtr<nsIURI> exposableURI;
+  nsresult rv = urifixup->CreateExposableURI(aURI, getter_AddRefs(exposableURI));
+  NS_ENSURE_SUCCESS_VOID(rv);
+
+  NS_ConvertUTF8toUTF16 spec(exposableURI->GetSpecOrDefault());
   const char16_t* params[] = { spec.get() };
 
   nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,

xpcom/build/Services.py

@@ -44,6 +44,8 @@ service('HistoryService', 'mozilla::IHistory',
         "@mozilla.org/browser/history;1")
 service('ThirdPartyUtil', 'mozIThirdPartyUtil',
         "@mozilla.org/thirdpartyutil;1")
+service('URIFixup', 'nsIURIFixup',
+        "@mozilla.org/docshell/urifixup;1")
 
 # The definition file needs access to the definitions of the particular
 # interfaces. If you add a new interface here, make sure the necessary includes
@@ -74,6 +76,7 @@ CPP_INCLUDES = """
 #include "nsIAsyncShutdown.h"
 #include "nsIUUIDGenerator.h"
 #include "nsIGfxInfo.h"
+#include "nsIURIFixup.h"
 """
 
 #####