From 302fa89c6f9a1997a9bab9dbce5d7e7b686f3f01 Mon Sep 17 00:00:00 2001
From: "dtownsend%oxymoronical.com"
 <dtownsend%oxymoronical.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 3 Dec 2007 12:24:41 +0000
Subject: [PATCH] Bug 406032: Block update info urls that are not http/https.
 r=robstrong, a=schrep

git-svn-id: svn://10.0.0.236/trunk@240298 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../mozapps/extensions/content/extensions.js  | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/mozilla/toolkit/mozapps/extensions/content/extensions.js b/mozilla/toolkit/mozapps/extensions/content/extensions.js
index bdad5c463eb..ef5e52cb431 100644
--- a/mozilla/toolkit/mozapps/extensions/content/extensions.js
+++ b/mozilla/toolkit/mozapps/extensions/content/extensions.js
@@ -1164,12 +1164,19 @@ function onAddonSelect(aEvent)
     }
     else if (gView == "updates") {
       UpdateInfoLoader.cancelLoad();
-      if (!gExtensionsView.selectedItem)
+      if (!gExtensionsView.selectedItem) {
         previewImageDeck.selectedIndex = 3;
-      else if (!gExtensionsView.selectedItem.hasAttribute("availableUpdateInfo"))
-        previewImageDeck.selectedIndex = 4;
-      else
-        UpdateInfoLoader.loadInfo(gExtensionsView.selectedItem.getAttribute("availableUpdateInfo"));
+      }
+      else {
+        try {
+          var uri = makeURI(gExtensionsView.selectedItem.getAttribute("availableUpdateInfo"));
+          var scheme = uri.scheme;
+        } catch (ex) {}
+        if (uri && (scheme == "http" || scheme == "https"))
+          UpdateInfoLoader.loadInfo(uri.spec);
+        else
+          previewImageDeck.selectedIndex = 4;
+      }
     }
   }
 }
@@ -1989,11 +1996,9 @@ var gExtensionsViewController = {
       if (!aSelectedItem) return;
       var homepageURL = aSelectedItem.getAttribute("homepageURL");
       // only allow http(s) homepages
-      var scheme = "";
-      var uri = null;
       try {
-        uri = makeURI(homepageURL);
-        scheme = uri.scheme;
+        var uri = makeURI(homepageURL);
+        var scheme = uri.scheme;
       } catch (ex) {}
       if (uri && (scheme == "http" || scheme == "https"))
         openURL(uri.spec);