From 43e230ebe25be8fc9c8f0542587f5ccc176070d6 Mon Sep 17 00:00:00 2001 From: "dougt%meer.net" Date: Thu, 29 May 2003 21:51:34 +0000 Subject: [PATCH] Disallowing javascript or data schemes in a redirect. r=mstoltz, sr=brendan, a=rjesup, b=195201 git-svn-id: svn://10.0.0.236/trunk@143053 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/caps/idl/nsIScriptSecurityManager.idl | 3 +++ mozilla/caps/src/nsScriptSecurityManager.cpp | 7 +++++++ mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp | 3 ++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/mozilla/caps/idl/nsIScriptSecurityManager.idl b/mozilla/caps/idl/nsIScriptSecurityManager.idl index f5bffba5b65..ff2d1b8a071 100644 --- a/mozilla/caps/idl/nsIScriptSecurityManager.idl +++ b/mozilla/caps/idl/nsIScriptSecurityManager.idl @@ -85,6 +85,9 @@ interface nsIScriptSecurityManager : nsIXPCSecurityManager // Allow the loading of chrome URLs by non-chrome URLs const unsigned long ALLOW_CHROME = 1 << 1; + // Don't allow javascript: (and data:) URLs to load + const unsigned long DISALLOW_JAVASCRIPT = 1 << 2; + /** * Check that content from "from" can load "uri". * diff --git a/mozilla/caps/src/nsScriptSecurityManager.cpp b/mozilla/caps/src/nsScriptSecurityManager.cpp index 7a8a0d2e0ca..34b9722ea5a 100644 --- a/mozilla/caps/src/nsScriptSecurityManager.cpp +++ b/mozilla/caps/src/nsScriptSecurityManager.cpp @@ -1216,6 +1216,13 @@ nsScriptSecurityManager::CheckLoadURI(nsIURI *aSourceURI, nsIURI *aTargetURI, return NS_OK; } + //-- Some callers do not allow loading javascript: or data: URLs + if ((aFlags & nsIScriptSecurityManager::DISALLOW_JAVASCRIPT) && + (targetScheme.Equals("javascript") || targetScheme.Equals("data"))) + { + return NS_ERROR_DOM_BAD_URI; + } + //-- If the schemes don't match, the policy is specified in this table. enum Action { AllowProtocol, DenyProtocol, PrefControlled, ChromeProtocol}; static const struct diff --git a/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp b/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp index f48ca72a8a7..72f13e42069 100644 --- a/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp +++ b/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp @@ -1777,7 +1777,8 @@ nsHttpChannel::ProcessRedirection(PRUint32 redirectType) do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID); if (securityManager) { rv = securityManager->CheckLoadURI(mURI, newURI, - nsIScriptSecurityManager::DISALLOW_FROM_MAIL); + nsIScriptSecurityManager::DISALLOW_FROM_MAIL | + nsIScriptSecurityManager::DISALLOW_JAVASCRIPT); if (NS_FAILED(rv)) return rv; }