Bug 162584: don't linkify javascript: and data: URLs in about:cache-entry. r=gordon, sr=darin

netwerk/protocol/about/src/nsAboutCacheEntry.cpp

@@ -408,10 +408,19 @@ nsAboutCacheEntry::WriteCacheEntryDescription(nsIOutputStream *outputStream,
     buffer.Append("<tr><td><tt><b>key:</b></tt></td><td>");
 
     // Test if the key is actually a URI
-    nsCOMPtr<nsIURI> uri;
-    rv = NS_NewURI(getter_AddRefs(uri), str);
+    nsCOMPtr<nsIURI> uri;
+    PRBool isJS = PR_FALSE;
+    PRBool isData = PR_FALSE;
+
+    rv = NS_NewURI(getter_AddRefs(uri), str);
+    // javascript: and data: URLs should not be linkified
+    // since clicking them can cause scripts to run - bug 162584
+    if (NS_SUCCEEDED(rv)) {
+        uri->SchemeIs("javascript", &isJS);
+        uri->SchemeIs("data", &isData);
+    }
     char* escapedStr = nsEscapeHTML(str);
-    if (NS_SUCCEEDED(rv)) {
+    if (NS_SUCCEEDED(rv) && !(isJS || isData)) {
         buffer.Append("<a href=\"");
         buffer.Append(escapedStr);
         buffer.Append("\">");