locationless windows need hostname in titlebar (match 1.0x -- bug 304388) r=mconnor/jruderman, sr=bzbarsky

content/html/document/src/nsHTMLDocument.cpp

@@ -1980,6 +1980,10 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
     SetDesignMode(NS_LITERAL_STRING("on"));
   }
 
+  // Zap the old title -- otherwise it would hang around until document.close()
+  // (which might never come) if the new document doesn't explicitly set one.
+  SetTitle(EmptyString());
+
   // Store the security info of the caller now that we're done
   // resetting the document.
   mSecurityInfo = securityInfo;

toolkit/content/widgets/tabbrowser.xml

@@ -562,21 +562,36 @@
           <![CDATA[
             var newTitle = "";
             var docTitle;
+            var docElement = this.ownerDocument.documentElement;
+            var sep = docElement.getAttribute("titlemenuseparator");
+
             if (this.docShell.contentViewer)
               docTitle = this.contentTitle;
             
             if (!docTitle)
-              docTitle = this.ownerDocument.documentElement.getAttribute("titledefault");
+              docTitle = docElement.getAttribute("titledefault");
 
-            var modifier = this.ownerDocument.documentElement.getAttribute("titlemodifier");
+            var modifier = docElement.getAttribute("titlemodifier");
             if (docTitle) {
-              newTitle += this.ownerDocument.documentElement.getAttribute("titlepreface");
+              newTitle += docElement.getAttribute("titlepreface");
               newTitle += docTitle;
-              var sep = this.ownerDocument.documentElement.getAttribute("titlemenuseparator");
               if (modifier)
                 newTitle += sep;
             }
             newTitle += modifier;
+            
+            // If location bar is hidden and the URL type supports a host,
+            // add the scheme and host to the title to prevent spoofing.
+            // XXX https://bugzilla.mozilla.org/show_bug.cgi?id=22183#c239
+            try {
+              if (docElement.getAttribute("chromehidden").indexOf("location") != -1) {
+                var host = this.mURIFixup.createExposableURI(
+                             this.mCurrentBrowser.currentURI).prePath;
+                if (host)
+                  newTitle = host + sep + newTitle;
+              }
+            } catch (e) {}
+                        
             this.ownerDocument.title = newTitle;
           ]]>
         </body>

xpfe/appshell/src/nsContentTreeOwner.cpp

@@ -57,6 +57,9 @@
 #include "nsIAuthPrompt.h"
 #include "nsIWindowMediator.h"
 #include "nsIXULBrowserWindow.h"
+#include "nsIPrincipal.h"
+#include "nsIURIFixup.h"
+#include "nsCDefaultURIFixup.h"
 
 // Needed for nsIDocument::FlushPendingNotifications(...)
 #include "nsIDOMDocument.h"
@@ -601,6 +604,58 @@ NS_IMETHODIMP nsContentTreeOwner::SetTitle(const PRUnichar* aTitle)
   else
     title.Assign(mWindowTitleModifier); // Title will just be plain "Mozilla"
 
+  //
+  // if there is no location bar we modify the title to display at least
+  // the scheme and host (if any) as an anti-spoofing measure.
+  //
+  nsCOMPtr<nsIDOMElement> docShellElement;
+  mXULWindow->GetWindowDOMElement(getter_AddRefs(docShellElement));
+
+  if (docShellElement) {
+    nsAutoString chromeString;
+    docShellElement->GetAttribute(NS_LITERAL_STRING("chromehidden"), chromeString);
+    if (chromeString.Find(NS_LITERAL_STRING("location")) != kNotFound) {
+      //
+      // location bar is turned off, find the browser location
+      //
+      // use the document's nsPrincipal to find the true owner
+      // in case of javascript: or data: documents
+      //
+      nsCOMPtr<nsIDocShellTreeItem> dsitem;
+      GetPrimaryContentShell(getter_AddRefs(dsitem));
+      nsCOMPtr<nsIDOMDocument> domdoc(do_GetInterface(dsitem));
+      nsCOMPtr<nsIDocument> doc(do_QueryInterface(domdoc));
+      if (doc) {
+        nsCOMPtr<nsIURI> uri;
+        nsIPrincipal* principal = doc->GetPrincipal();
+        if (principal) {
+          principal->GetURI(getter_AddRefs(uri));
+          if (uri) {
+            //
+            // remove any user:pass information
+            //
+            nsCOMPtr<nsIURIFixup> fixup(do_GetService(NS_URIFIXUP_CONTRACTID));
+            if (fixup) {
+              nsCOMPtr<nsIURI> tmpuri;
+              nsresult rv = fixup->CreateExposableURI(uri,getter_AddRefs(tmpuri));
+              if (NS_SUCCEEDED(rv) && tmpuri) {
+                nsCAutoString prepath;
+                tmpuri->GetPrePath(prepath);
+                if (!prepath.IsEmpty()) {
+                  //
+                  // We have a scheme/host, update the title
+                  //
+                  title.Insert(NS_ConvertUTF8toUTF16(prepath) +
+                               mTitleSeparator, 0);
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
   return mXULWindow->SetTitle(title.get());
 }
 

xpfe/global/resources/content/bindings/tabbrowser.xml

@@ -495,15 +495,31 @@
           <![CDATA[
             var newTitle = "";
             var docTitle;
+            var docElement = this.ownerDocument.documentElement;
+            var sep = docElement.getAttribute("titlemenuseparator");
+
             if (this.docShell.contentViewer)
               docTitle = this.contentTitle;
 
             if (docTitle) {
-              newTitle += this.ownerDocument.documentElement.getAttribute("titlepreface");
+              newTitle += docElement.getAttribute("titlepreface");
               newTitle += docTitle;
-              newTitle += this.ownerDocument.documentElement.getAttribute("titlemenuseparator");
+              newTitle += sep;
             }
-            newTitle += this.ownerDocument.documentElement.getAttribute("titlemodifier");
+            newTitle += docElement.getAttribute("titlemodifier");
+
+            // If location bar is hidden and the URL type supports a host,
+            // add the scheme and host to the title to prevent spoofing.
+            // XXX https://bugzilla.mozilla.org/show_bug.cgi?id=22183#c239
+            try {
+              if (docElement.getAttribute("chromehidden").indexOf("location") != -1) {
+                var host = this.mURIFixup.createExposableURI(
+                             this.mCurrentBrowser.currentURI).prePath;
+                if (host)
+                  newTitle = host + sep + newTitle;
+              }
+            } catch (e) {}
+
             this.ownerDocument.title = newTitle;
           ]]>
         </body>