wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 285438 Drag and drop gestures can be hijacked to load priviliged xul - xpfe/toolkit trunk patch v2.0 p=jst/me r=neil.parkwaycc.co.uk sr=bzbarsky a=benjamin

Browse Source
This commit is contained in:
bugzilla@arlen.demon.co.uk 2007-08-21 22:00:22 -07:00
parent 24d00d1cb8
commit b22a77a6da
1 changed files with 34 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
browser/base/content/tabbrowser.xml
View File

@ -1849,7 +1849,7 @@
<method name="dragDropSecurityCheck"> <method name="dragDropSecurityCheck">
<parameter name="aEvent"/> <parameter name="aEvent"/>
<parameter name="aDragSession"/> <parameter name="aDragSession"/>
<parameter name="aUrl"/> <parameter name="aUri"/>
<body> <body>
<![CDATA[ <![CDATA[
// Do a security check for drag n' drop. Make sure the // Do a security check for drag n' drop. Make sure the
@ -1857,22 +1857,44 @@
var sourceDoc = aDragSession.sourceDocument; var sourceDoc = aDragSession.sourceDocument;
if (sourceDoc) { if (sourceDoc) {
var sourceURI = sourceDoc.documentURI; // Strip leading and trailing whitespace, then try to
// create a URI from the dropped string. If that
// succeeds, we're dropping a URI and we need to do a
// security check to make sure the source document can
// load the dropped URI. We don't so much care about
// creating the real URI here (i.e. encoding differences
// etc don't matter), we just want to know if aUri
// really is a URI.
const nsIScriptSecurityManager = var uriStr = aUri.replace(/^\s*|\s*$/g, '');
Components.interfaces.nsIScriptSecurityManager; var uri = null;
var secMan =
Components.classes["@mozilla.org/scriptsecuritymanager;1"]
.getService(nsIScriptSecurityManager);
try { try {
secMan.checkLoadURIStr(sourceURI, aUrl, uri = Components.classes["@mozilla.org/network/io-service;1"]
nsIScriptSecurityManager.STANDARD); .getService(Components.interfaces.nsIIOService)
.newURI(uriStr, null, null);
} catch (e) { } catch (e) {
// Stop event propagation right here. }
aEvent.stopPropagation();
throw "Drop of " + aUrl + " denied."; if (uri) {
// aUri is a URI, do the security check.
var sourceURI = sourceDoc.documentURI;
const nsIScriptSecurityManager =
Components.interfaces.nsIScriptSecurityManager;
var secMan =
Components.classes["@mozilla.org/scriptsecuritymanager;1"]
.getService(nsIScriptSecurityManager);
try {
secMan.checkLoadURIStr(sourceURI, uriStr,
nsIScriptSecurityManager.STANDARD);
} catch (e) {
// Stop event propagation right here.
aEvent.stopPropagation();
throw "Drop of " + aUri + " denied.";
}
} }
} }
]]> ]]>