Bug 1964955 - Make sure NavigateEvent.intercept can execute. r=smaug

Intercept was prevented by four things:

1) the return value of FirePushReplaceReloadNavigateEvent for
   pushState was used inverted.
2) the event was created untrusted
3) the wrong flag was being checked to see if the event was in the
   process of being dispatched.
4) wrong uri equality method was used.

Differential Revision: https://phabricator.services.mozilla.com/D248222
This commit is contained in:
Andreas Farre
2025-05-07 14:22:59 +00:00
committed by afarre@mozilla.com
parent 74378bf229
commit 6ab0d18691
5 changed files with 34 additions and 19 deletions

View File

@@ -11405,19 +11405,23 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
// https://html.spec.whatwg.org/#shared-history-push/replace-state-steps
// Step 8
if (nsCOMPtr<nsPIDOMWindowInner> window = document->GetInnerWindow()) {
if (RefPtr<Navigation> navigation = window->Navigation();
navigation &&
navigation->FirePushReplaceReloadNavigateEvent(
aCx, aReplace ? NavigationType::Replace : NavigationType::Push,
newURI,
/* aIsSameDocument */ true, /* aUserInvolvement */ Nothing(),
/* aSourceElement */ nullptr, /* aFormDataEntryList */ Nothing(),
/* aNavigationAPIState */ nullptr, scContainer)) {
return NS_OK;
if (RefPtr<Navigation> navigation = window->Navigation()) {
bool shouldContinue = navigation->FirePushReplaceReloadNavigateEvent(
aCx, aReplace ? NavigationType::Replace : NavigationType::Push,
newURI,
/* aIsSameDocument */ true, /* aUserInvolvement */ Nothing(),
/* aSourceElement */ nullptr, /* aFormDataEntryList */ Nothing(),
/* aNavigationAPIState */ nullptr, scContainer);
// Step 9
if (!shouldContinue) {
return NS_OK;
}
}
}
// Step 8: call "URL and history update steps"
// Step 10
// Run #url-and-history-update-steps
rv = UpdateURLAndHistory(document, newURI, scContainer,
aReplace ? NavigationHistoryBehavior::Replace
: NavigationHistoryBehavior::Push,