зеркало из https://github.com/mozilla/gecko-dev.git
Backed out changeset 4270e8daf3cf (bug 1395948
) for build bustage at docshell/base/nsDocShellLoadTypes.h:22. r=backout on a CLOSED TREE
This commit is contained in:
Родитель
299370b2ab
Коммит
50778e172c
|
@ -9928,39 +9928,6 @@ nsDocShell::InternalLoad(nsIURI* aURI,
|
||||||
isTargetTopLevelDocShell = true;
|
isTargetTopLevelDocShell = true;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (contentType == nsIContentPolicy::TYPE_DOCUMENT &&
|
|
||||||
nsIOService::BlockToplevelDataUriNavigations()) {
|
|
||||||
bool isDataURI =
|
|
||||||
(NS_SUCCEEDED(aURI->SchemeIs("data", &isDataURI)) && isDataURI);
|
|
||||||
// Let's block all toplevel document navigations to a data: URI.
|
|
||||||
// In all cases where the toplevel document is navigated to a
|
|
||||||
// data: URI the triggeringPrincipal is a codeBasePrincipal, or
|
|
||||||
// a NullPrincipal. In other cases, e.g. typing a data: URL into
|
|
||||||
// the URL-Bar, the triggeringPrincipal is a SystemPrincipal;
|
|
||||||
// we don't want to block those loads. Only exception, loads coming
|
|
||||||
// from an external applicaton (e.g. Thunderbird) don't load
|
|
||||||
// using a codeBasePrincipal, but we want to block those loads.
|
|
||||||
bool loadFromExternal =
|
|
||||||
LOAD_TYPE_HAS_FLAGS(aLoadType, LOAD_NORMAL_EXTERNAL);
|
|
||||||
if (isDataURI && (loadFromExternal ||
|
|
||||||
!nsContentUtils::IsSystemPrincipal(aTriggeringPrincipal))) {
|
|
||||||
NS_ConvertUTF8toUTF16 specUTF16(aURI->GetSpecOrDefault());
|
|
||||||
if (specUTF16.Length() > 50) {
|
|
||||||
specUTF16.Truncate(50);
|
|
||||||
specUTF16.AppendLiteral("...");
|
|
||||||
}
|
|
||||||
const char16_t* params[] = { specUTF16.get() };
|
|
||||||
nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
|
|
||||||
NS_LITERAL_CSTRING("DATA_URI_BLOCKED"),
|
|
||||||
// no doc available, log to browser console
|
|
||||||
nullptr,
|
|
||||||
nsContentUtils::eSECURITY_PROPERTIES,
|
|
||||||
"BlockTopLevelDataURINavigation",
|
|
||||||
params, ArrayLength(params));
|
|
||||||
return NS_OK;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// If there's no targetDocShell, that means we are about to create a new
|
// If there's no targetDocShell, that means we are about to create a new
|
||||||
// window (or aWindowTarget is empty). Perform a content policy check before
|
// window (or aWindowTarget is empty). Perform a content policy check before
|
||||||
// creating the window.
|
// creating the window.
|
||||||
|
@ -11138,6 +11105,37 @@ nsDocShell::DoURILoad(nsIURI* aURI,
|
||||||
new LoadInfo(loadingPrincipal, aTriggeringPrincipal, loadingNode,
|
new LoadInfo(loadingPrincipal, aTriggeringPrincipal, loadingNode,
|
||||||
securityFlags, aContentPolicyType);
|
securityFlags, aContentPolicyType);
|
||||||
|
|
||||||
|
if (aContentPolicyType == nsIContentPolicy::TYPE_DOCUMENT &&
|
||||||
|
nsIOService::BlockToplevelDataUriNavigations()) {
|
||||||
|
bool isDataURI =
|
||||||
|
(NS_SUCCEEDED(aURI->SchemeIs("data", &isDataURI)) && isDataURI);
|
||||||
|
// Let's block all toplevel document navigations to a data: URI.
|
||||||
|
// In all cases where the toplevel document is navigated to a
|
||||||
|
// data: URI the triggeringPrincipal is a codeBasePrincipal, or
|
||||||
|
// a NullPrincipal. In other cases, e.g. typing a data: URL into
|
||||||
|
// the URL-Bar, the triggeringPrincipal is a SystemPrincipal;
|
||||||
|
// we don't want to block those loads. Only exception, loads coming
|
||||||
|
// from an external applicaton (e.g. Thunderbird) don't load
|
||||||
|
// using a codeBasePrincipal, but we want to block those loads.
|
||||||
|
if (isDataURI && (aLoadFromExternal ||
|
||||||
|
!nsContentUtils::IsSystemPrincipal(aTriggeringPrincipal))) {
|
||||||
|
NS_ConvertUTF8toUTF16 specUTF16(aURI->GetSpecOrDefault());
|
||||||
|
if (specUTF16.Length() > 50) {
|
||||||
|
specUTF16.Truncate(50);
|
||||||
|
specUTF16.AppendLiteral("...");
|
||||||
|
}
|
||||||
|
const char16_t* params[] = { specUTF16.get() };
|
||||||
|
nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
|
||||||
|
NS_LITERAL_CSTRING("DATA_URI_BLOCKED"),
|
||||||
|
// no doc available, log to browser console
|
||||||
|
nullptr,
|
||||||
|
nsContentUtils::eSECURITY_PROPERTIES,
|
||||||
|
"BlockTopLevelDataURINavigation",
|
||||||
|
params, ArrayLength(params));
|
||||||
|
return NS_OK;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
if (aPrincipalToInherit) {
|
if (aPrincipalToInherit) {
|
||||||
loadInfo->SetPrincipalToInherit(aPrincipalToInherit);
|
loadInfo->SetPrincipalToInherit(aPrincipalToInherit);
|
||||||
}
|
}
|
||||||
|
|
Загрузка…
Ссылка в новой задаче