From 573c7561dee7339b6cfa991a3af0293ef5dc4472 Mon Sep 17 00:00:00 2001
From: "nisheeth%netscape.com"
 <nisheeth%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 27 Jul 2006 14:57:06 +0000
Subject: [PATCH] Fix for bug 161546. r=alecf, sr=heikki.  JS and data urls can
 no longer be loaded from the history window or sidebar.  An alert with an
 error will pop up if a user tries to load such urls from the history
 window/sidebar. a=asa.

git-svn-id: svn://10.0.0.236/trunk@204807 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/suite/common/history/history.js         | 17 ++++++++++++++++-
 .../chrome/common/history/history.properties    |  2 ++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/mozilla/suite/common/history/history.js b/mozilla/suite/common/history/history.js
index b832a1da48b..49cfc58d38c 100644
--- a/mozilla/suite/common/history/history.js
+++ b/mozilla/suite/common/history/history.js
@@ -278,7 +278,22 @@ function OpenURL(aInNewWindow)
     var currentIndex = gHistoryTree.currentIndex;     
     var builder = gHistoryTree.builder.QueryInterface(Components.interfaces.nsIXULTreeBuilder);
     var url = builder.getResourceAtIndex(currentIndex).Value;
-    
+    var uri = Components.classes["@mozilla.org/network/standard-url;1"].
+                createInstance(Components.interfaces.nsIURI);
+    uri.spec = url;
+    if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
+      var strBundleService = Components.classes["@mozilla.org/intl/stringbundle;1"]
+                                       .getService(Components.interfaces.nsIStringBundleService);
+      var promptService = Components.classes["@mozilla.org/embedcomp/prompt-service;1"]
+                                    .getService(Components.interfaces.nsIPromptService);
+      var historyBundle = strBundleService.createBundle("chrome://communicator/locale/history/history.properties");
+      var brandBundle = strBundleService.createBundle("chrome://global/locale/brand.properties");      
+      var brandStr = brandBundle.GetStringFromName("brandShortName");
+      var errorStr = historyBundle.GetStringFromName("load-js-data-url-error");
+      promptService.alert(window, brandStr, errorStr);
+      return false;
+    }
+
     if (aInNewWindow) {
       var count = gHistoryTree.treeBoxObject.view.selection.count;
       if (count == 1) {
diff --git a/mozilla/suite/locales/en-US/chrome/common/history/history.properties b/mozilla/suite/locales/en-US/chrome/common/history/history.properties
index 13c7104a1b7..94d90217af9 100644
--- a/mozilla/suite/locales/en-US/chrome/common/history/history.properties
+++ b/mozilla/suite/locales/en-US/chrome/common/history/history.properties
@@ -17,3 +17,5 @@ collapseLabel=Collapse
 expandLabel=Expand
 collapseAccesskey=C
 expandAccesskey=x
+
+load-js-data-url-error=For security reasons, javascript or data urls cannot be loaded from the history window or sidebar.