corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1909051 - Disable HTTPS-Only for drag-and-drop requests r=tschuster,win-reviewers,gstoll

Browse Source 
HTTPS-Only should be disabled for any repeated request caused by a file
drag-and-drop, as HTTPS-Only may block the repeated request if it is insecure,
even if the original request was exempt from HTTPS-Only. Disabling HTTPS-Only
completely is fine in this case, because if we are dragging from an insecure
source, that source must already be exempt from HTTPS-Only, as it otherwise
would have been upgraded already by HTTPS-Only.

The changes in nsContentAreaDragDrop and nsWebBrowserPersist fix this problem on
macOS, the changes in widget/windows/nsDataObj fix it in Windows.

Differential Revision: https://phabricator.services.mozilla.com/D244905
This commit is contained in:
Malte Jürgens
2025-04-28 15:31:41 +00:00
parent 2c7bda9b59
commit 2fa5b90986
4 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
dom/base/nsContentAreaDragDrop.cpp
View File

@@ -146,7 +146,11 @@ nsresult nsContentAreaDragDropDataProvider::SaveURIToFile(
NS_ENSURE_SUCCESS(rv, rv);
persist->SetPersistFlags(
nsIWebBrowserPersist::PERSIST_FLAGS_AUTODETECT_APPLY_CONVERSION);
nsIWebBrowserPersist::PERSIST_FLAGS_AUTODETECT_APPLY_CONVERSION |
// Do not HTTPS-Only/-First upgrade this request. If we reach this point,
// any potential upgrades should have already happened, or the URI may
// have already been exempt.
nsIWebBrowserPersist::PERSIST_FLAGS_DISABLE_HTTPS_ONLY);
// referrer policy can be anything since the referrer is nullptr
return persist->SaveURI(inSourceURI, inTriggeringPrincipal, 0, nullptr,

2
dom/webbrowserpersist/nsIWebBrowserPersist.idl
View File

@@ -68,6 +68,8 @@ interface nsIWebBrowserPersist : nsICancelable
* This can only be used when persisting to a local file.
*/
const unsigned long PERSIST_FLAGS_APPEND_TO_FILE = 32768;
/** Unconditionally disable HTTPS-Only and HTTPS-First upgrades */
const unsigned long PERSIST_FLAGS_DISABLE_HTTPS_ONLY = 65536;
/**
* Flags governing how data is fetched and saved from the network.

3
dom/webbrowserpersist/nsWebBrowserPersist.cpp
View File

@@ -1379,6 +1379,9 @@ nsresult nsWebBrowserPersist::SaveURIInternal(
nsCOMPtr<nsILoadInfo> loadInfo = inputChannel->LoadInfo();
loadInfo->SetIsUserTriggeredSave(true);
if (mPersistFlags & nsIWebBrowserPersist::PERSIST_FLAGS_DISABLE_HTTPS_ONLY) {
loadInfo->SetHttpsOnlyStatus(nsILoadInfo::HTTPS_ONLY_EXEMPT);
}
// Set the referrer, post data and headers if any
nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(inputChannel));

6
widget/windows/nsDataObj.cpp
View File

@@ -102,6 +102,12 @@ nsresult nsDataObj::CStream::Init(nsIURI* pSourceURI,
Unused << NS_WARN_IF(NS_FAILED(rv));
}
// Do not HTTPS-Only/-First upgrade this request. If we reach this point, any
// potential upgrades should have already happened, or the URI may have
// already been exempt.
nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
loadInfo->SetHttpsOnlyStatus(nsILoadInfo::HTTPS_ONLY_EXEMPT);
rv = mChannel->AsyncOpen(this);
NS_ENSURE_SUCCESS(rv, rv);
return NS_OK;