Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Copy the security checks for history items to placescontroller/utils, r=sspitzer (patch on bug 362292).

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@219522 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mozilla.mano%sent.com 2007-02-05 20:38:52 +00:00
parent 11a3e8f918
commit 4e4eab18f2
3 changed files with 33 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mozilla/browser/components/places/content/controller.js
View File

@ -915,7 +915,7 @@ PlacesController.prototype = {
*/
openSelectedNodeWithEvent: function PC_openSelectedNodeWithEvent(aEvent) {
var node = this._view.selectedURINode;
if (node)
if (node && PlacesUtils.checkURLSecurity(node))
openUILink(node.uri, aEvent);
},
@ -925,7 +925,7 @@ PlacesController.prototype = {
*/
openSelectedNodeIn: function PC_openSelectedNodeIn(aWhere) {
var node = this._view.selectedURINode;
if (node)
if (node && PlacesUtils.checkURLSecurity(node))
openUILinkIn(node.uri, aWhere);
},

30
mozilla/browser/components/places/content/utils.js
View File

@ -162,7 +162,7 @@ var PlacesUtils = {
}
return this.__bundle;
},
getFormattedString: function PU_getFormattedString(key, params) {
return this._bundle.formatStringFromName(key, params, params.length);
},
@ -698,5 +698,33 @@ var PlacesUtils = {
}
return null;
},
/**
* Allows opening of javascript/data URI only if the given node is
* bookmarked (see bug 224521).
* @param aURINode
* a URI node
* @return true if it's safe to open the node in the browser, false otherwise.
*
*/
checkURLSecurity: function PU_checkURLSecurity(aURINode) {
if (!this.nodeIsBookmark(aURINode)) {
var uri = this._uri(aURINode.uri);
if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
const BRANDING_BUNDLE_URI = "chrome://branding/locale/brand.properties";
var brandShortName = Cc["@mozilla.org/intl/stringbundle;1"].
getService(Ci.nsIStringBundleService).
createBundle(BRANDING_BUNDLE_URI).
GetStringFromName("brandShortName");
var promptService = Cc["@mozilla.org/embedcomp/prompt-service;1"].
getService(Ci.nsIPromptService);
var errorStr = this.getString("load-js-data-url-error");
promptService.alert(window, brandStr, errorStr);
return false;
}
}
return true;
}
};

2
mozilla/browser/locales/en-US/chrome/browser/places/places.properties
View File

@ -74,3 +74,5 @@ tabs.openButtonMultiple=Open tabs
tabs.openWarningPromptMeBranded=Warn me when opening multiple tabs might slow down %S
status_foldercount = %S object(s)
load-js-data-url-error=For security reasons, javascript or data urls cannot be loaded from the history window or sidebar.