From b298946c00570aefc8b07aaa9d6a93564ef1ff4c Mon Sep 17 00:00:00 2001 From: Edgar Chen Date: Mon, 13 Jan 2025 00:19:00 +0000 Subject: [PATCH] Bug 1934807 - Consider file: URIs as the same domain for the purpose of frame navigation; r=smaug Differential Revision: https://phabricator.services.mozilla.com/D232451 --- docshell/base/nsDocShell.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 2ece88b9a272..f3069febc1bd 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -8050,6 +8050,7 @@ nsresult nsDocShell::CheckLoadingPermissions() { // Check if the caller is from the same origin as this docshell, // or any of its ancestors. + nsIPrincipal* subjectPrincipal = nsContentUtils::SubjectPrincipal(); for (RefPtr bc = mBrowsingContext; bc; bc = bc->GetParent()) { // If the BrowsingContext is not in process, then it @@ -8068,7 +8069,11 @@ nsresult nsDocShell::CheckLoadingPermissions() { return NS_ERROR_UNEXPECTED; } - if (nsContentUtils::SubjectPrincipal()->Subsumes(p)) { + // file: URIs are considered the same domain for the purpose of frame + // navigation by clicking a targeted link, regardless of script + // accessibility (bug 1934807). + if (subjectPrincipal->Subsumes(p) || + (subjectPrincipal->SchemeIs("file") && p->SchemeIs("file"))) { // Same origin, permit load return NS_OK; }