diff --git a/mozilla/docshell/test/Makefile.in b/mozilla/docshell/test/Makefile.in index 384aec1112a..2078525a546 100644 --- a/mozilla/docshell/test/Makefile.in +++ b/mozilla/docshell/test/Makefile.in @@ -59,6 +59,7 @@ _TEST_FILES = \ test_bug344861.html \ test_bug369814.html \ bug369814.zip \ + bug369814.jar \ test_bug384014.html \ test_bug387979.html \ test_bug404548.html \ diff --git a/mozilla/docshell/test/test_bug369814.html b/mozilla/docshell/test/test_bug369814.html index 85a7b3bdb7a..7944b950488 100644 --- a/mozilla/docshell/test/test_bug369814.html +++ b/mozilla/docshell/test/test_bug369814.html @@ -149,6 +149,18 @@ var gTests = [ "pokes" : { }, "func" : anchorTest, }, + { "name" : "iframes.html loaded from view-source jar type, pref disabled", + "url" : "jar:view-source:http://localhost:8888/tests/docshell/test/bug369814.jar!/iframes.html", + "pref" : true, + "pokes" : { }, + "func" : loadErrorTest + }, + { "name" : "iframes.html loaded from view-source jar type, pref enabled", + "url" : "jar:view-source:http://localhost:8888/tests/docshell/test/bug369814.jar!/iframes.html", + "pref" : true, + "pokes" : { }, + "func" : loadErrorTest + }, ]; var gNextTest = 0; diff --git a/mozilla/modules/libjar/nsJARChannel.cpp b/mozilla/modules/libjar/nsJARChannel.cpp index 088dd8e91b0..a09d1bee4a1 100644 --- a/mozilla/modules/libjar/nsJARChannel.cpp +++ b/mozilla/modules/libjar/nsJARChannel.cpp @@ -46,6 +46,7 @@ #include "nsEscape.h" #include "nsIPrefService.h" #include "nsIPrefBranch.h" +#include "nsIViewSourceChannel.h" #include "nsChannelProperties.h" #include "nsIScriptSecurityManager.h" @@ -775,8 +776,11 @@ nsJARChannel::OnDownloadComplete(nsIDownloader *downloader, nsCAutoString contentType; nsCAutoString charset; NS_ParseContentType(header, contentType, charset); - mIsUnsafe = !contentType.EqualsLiteral("application/java-archive") && - !contentType.EqualsLiteral("application/x-jar"); + nsCAutoString channelContentType; + channel->GetContentType(channelContentType); + mIsUnsafe = !(contentType.Equals(channelContentType) && + (contentType.EqualsLiteral("application/java-archive") || + contentType.EqualsLiteral("application/x-jar"))); rv = httpChannel->GetResponseHeader(NS_LITERAL_CSTRING("Content-Disposition"), header); if (NS_SUCCEEDED(rv)) @@ -809,6 +813,14 @@ nsJARChannel::OnDownloadComplete(nsIDownloader *downloader, } } + if (NS_SUCCEEDED(status)) { + // Refuse to unpack view-source: jars even if open-unsafe-types is set. + nsCOMPtr viewSource = do_QueryInterface(channel); + if (viewSource) { + status = NS_ERROR_UNSAFE_CONTENT_TYPE; + } + } + if (NS_SUCCEEDED(status)) { mJarFile = file;