corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1175653 - only allow local schemes for the chrome commandline flag, r=dveditz

Browse Source
This commit is contained in:
Gijs Kruitbosch
2015-06-25 13:25:56 -07:00
parent b90d5da8db
commit 6a7bc1d121
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
browser/components/nsBrowserContentHandler.js
View File

@@ -393,14 +393,26 @@ nsBrowserContentHandler.prototype = {
openPreferences();
cmdLine.preventDefault = true;
} else try {
// only load URIs which do not inherit chrome privs
var features = "chrome,dialog=no,all" + this.getFeatures(cmdLine);
var uri = resolveURIInternal(cmdLine, chromeParam);
var netutil = Components.classes["@mozilla.org/network/util;1"]
.getService(nsINetUtil);
if (!netutil.URIChainHasFlags(uri, URI_INHERITS_SECURITY_CONTEXT)) {
openWindow(null, uri.spec, "_blank", features);
cmdLine.preventDefault = true;
let isLocal = (uri) => {
let localSchemes = new Set("chrome", "file", "resource");
if (uri instanceof Components.interfaces.nsINestedURI) {
uri = uri.QueryInterface(Components.interfaces.nsINestedURI).innerMostURI;
}
return localSchemes.has(uri.scheme);
};
if (isLocal(uri)) {
// only load URIs which do not inherit chrome privs
var features = "chrome,dialog=no,all" + this.getFeatures(cmdLine);
var netutil = Components.classes["@mozilla.org/network/util;1"]
.getService(nsINetUtil);
if (!netutil.URIChainHasFlags(uri, URI_INHERITS_SECURITY_CONTEXT)) {
openWindow(null, uri.spec, "_blank", features);
cmdLine.preventDefault = true;
}
} else {
dump("*** Preventing load of web URI as chrome\n");
dump(" If you're trying to load a webpage, do not pass --chrome.\n");
}
}
catch (e) {