From 3002020702fe689fa3c7cd334932a5092ba9252c Mon Sep 17 00:00:00 2001
From: Tom Ritter <tom@mozilla.com>
Date: Mon, 2 Dec 2019 15:45:57 +0000
Subject: [PATCH] Bug 1582512 - Disable script filename validation in Browser
 Toolbox console debugging r=jimb

Differential Revision: https://phabricator.services.mozilla.com/D53234

--HG--
extra : moz-landing-system : lando
---
 js/src/debugger/Frame.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/debugger/Frame.cpp b/js/src/debugger/Frame.cpp
index 9b93d3dcbc47..7e3b39e4be60 100644
--- a/js/src/debugger/Frame.cpp
+++ b/js/src/debugger/Frame.cpp
@@ -861,7 +861,12 @@ static bool EvaluateInEnv(JSContext* cx, Handle<Env*> env,
   options.setIsRunOnce(true)
       .setNoScriptRval(false)
       .setFileAndLine(filename, lineno)
-      .setIntroductionType("debugger eval");
+      .setIntroductionType("debugger eval")
+      /* Do not perform the Javascript filename validation security check for
+       * javascript executions sent through the debugger. Besides making up
+       * a filename for these codepaths, we must allow arbitrary JS execution
+       * for the Browser toolbox to function. */
+      .setSkipFilenameValidation(true);
 
   if (frame && frame.hasScript() && frame.script()->strict()) {
     options.setForceStrictMode();