wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 776606 - Possible chrome-level JS injection attack with user portraits in the Social API. r=gavin

Browse Source
This commit is contained in:
Jared Wein 2012-07-30 19:28:23 -07:00
parent 73b3aac203
commit 0fe187f956
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
browser/base/content/browser-social.js
View File

@ -160,10 +160,10 @@ let SocialShareButton = {
updateProfileInfo: function SSB_updateProfileInfo() {
let profileRow = document.getElementById("editSharePopupHeader");
let profile = Social.provider.profile;
if (profile && profile.portrait && profile.displayName) {
if (profile && profile.displayName) {
profileRow.hidden = false;
let portrait = document.getElementById("socialUserPortrait");
portrait.style.listStyleImage = profile.portrait;
portrait.setAttribute("src", profile.portrait || "chrome://browser/skin/social/social.png");
let displayName = document.getElementById("socialUserDisplayName");
displayName.setAttribute("label", profile.displayName);
} else {

14
toolkit/components/social/SocialService.jsm
View File

@ -201,6 +201,20 @@ SocialProvider.prototype = {
updateUserProfile: function(profile) {
this.profile = profile;
// Sanitize the portrait from any potential script-injection.
if (profile.portrait) {
try {
let portraitUri = Services.io.newURI(profile.portrait, null, null);
let scheme = portraitUri ? portraitUri.scheme : "";
if (scheme != "data" && scheme != "http" && scheme != "https") {
profile.portrait = "";
}
} catch (ex) {
profile.portrait = "";
}
}
if (profile.iconURL)
this.iconURL = profile.iconURL;