Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 54966, 54845, 55906: Prevent psm-glue from accidentally cancelling form submit for file: urls, javascript: urls, and submits to 127.0.0.1 r=javi,jst sr=mscott

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@80924 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
pollmann%netscape.com 2000-10-11 09:53:29 +00:00
parent 2449da4f29
commit 80287fae49
7 changed files with 32 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mozilla/content/html/content/public/nsIFormSubmitObserver.h
View File

@ -54,9 +54,9 @@ public:
* NOTE: This is not necessarily the same window the form submit result
* will be loaded in (form could have target attribute set)
* @param actionURL- URL to which the form will be submitted.
* @param cancelSubmit- outparam - cancels form submit if set to true
*/
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL) = 0;
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL, PRBool* cancelSubmit) = 0;
};

29
mozilla/extensions/psm-glue/src/nsSecureBrowserUIImpl.cpp
View File

@ -248,10 +248,10 @@ static nsresult IsChildOfDomWindow(nsIDOMWindow *parent, nsIDOMWindow *child, PR
NS_IMETHODIMP
nsSecureBrowserUIImpl::Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL)
nsSecureBrowserUIImpl::Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL, PRBool* cancelSubmit)
{
// Return NS_OK unless we want to prevent this form from submitting.
*cancelSubmit = PR_FALSE;
if (!window || !actionURL || !formNode) {
return NS_OK;
}
@ -267,16 +267,17 @@ nsSecureBrowserUIImpl::Notify(nsIContent* formNode, nsIDOMWindowInternal* window
PRBool isChild;
IsChildOfDomWindow(mWindow, postingWindow, &isChild);
// This notify call is not for our window, ignore it.
if (!isChild)
return NS_OK;
PRBool okayToPost;
nsresult res = CheckPost(actionURL, &okayToPost);
if (NS_SUCCEEDED(res) && okayToPost)
return NS_OK;
if (NS_SUCCEEDED(res) && !okayToPost)
*cancelSubmit = PR_TRUE;
return NS_ERROR_FAILURE;
return res;
}
// nsIWebProgressListener
@ -535,8 +536,10 @@ nsSecureBrowserUIImpl::IsURLHTTPS(nsIURI* aURL, PRBool* value)
char* scheme;
aURL->GetScheme(&scheme);
// If no scheme, it's not an https url - not necessarily an error.
// See bugs 54845 and 54966
if (scheme == nsnull)
return NS_ERROR_NULL_POINTER;
return NS_OK;
if ( PL_strncasecmp(scheme, "https", 5) == 0 )
*value = PR_TRUE;
@ -557,8 +560,10 @@ nsSecureBrowserUIImpl::IsURLfromPSM(nsIURI* aURL, PRBool* value)
nsXPIDLCString host;
aURL->GetHost(getter_Copies(host));
// This may legitimately be null, for example a javascript: or file: url
// See bug 54966 and 54845
if (host == nsnull)
return NS_ERROR_NULL_POINTER;
return NS_OK;
if ( PL_strncasecmp(host, "127.0.0.1", 9) == 0 ) {
nsresult res;
@ -575,8 +580,9 @@ nsSecureBrowserUIImpl::IsURLfromPSM(nsIURI* aURL, PRBool* value)
nsXPIDLCString password;
aURL->GetPassword(getter_Copies(password));
// Bug 55906: this is not guaranteed to be present
if (password == nsnull) {
return NS_ERROR_NULL_POINTER;
return NS_OK;
}
if (PL_strncasecmp(password, (const char*)control->nonce.data, control->nonce.len) == 0) {
@ -757,6 +763,7 @@ nsresult
nsSecureBrowserUIImpl::CheckPost(nsIURI *actionURL, PRBool *okayToPost)
{
PRBool secure, isSecurityAdvisor;
*okayToPost = PR_TRUE;
nsresult rv = IsURLHTTPS(actionURL, &secure);
if (NS_FAILED(rv))
@ -764,7 +771,6 @@ nsSecureBrowserUIImpl::CheckPost(nsIURI *actionURL, PRBool *okayToPost)
// if we are posting to a secure link from a secure page, all is okay.
if (secure && mIsSecureDocument) {
*okayToPost = PR_TRUE;
return NS_OK;
}
@ -775,7 +781,6 @@ nsSecureBrowserUIImpl::CheckPost(nsIURI *actionURL, PRBool *okayToPost)
}
if (isSecurityAdvisor) {
*okayToPost = PR_TRUE;
return NS_OK;
}
@ -816,10 +821,8 @@ nsSecureBrowserUIImpl::CheckPost(nsIURI *actionURL, PRBool *okayToPost)
NS_WITH_SERVICE(nsIPSMComponent, psm, PSM_COMPONENT_CONTRACTID, &rv);
if (NS_FAILED(rv))
return rv;
psm->PassPrefs();
return psm->PassPrefs();
}
} else {
*okayToPost = PR_TRUE;
}
return NS_OK;

2
mozilla/extensions/psm-glue/src/nsSecureBrowserUIImpl.h
View File

@ -69,7 +69,7 @@ public:
// nsIObserver
NS_DECL_NSIOBSERVER
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI *actionURL);
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI *actionURL, PRBool* cancelSubmit);
protected:

2
mozilla/extensions/wallet/src/nsWalletService.cpp
View File

@ -166,7 +166,7 @@ NS_IMETHODIMP nsWalletlibService::Observe(nsISupports*, const PRUnichar*, const
}
#define CRLF "\015\012"
NS_IMETHODIMP nsWalletlibService::Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL)
NS_IMETHODIMP nsWalletlibService::Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL, PRBool* cancelSubmit)
{
if (!formNode) {
return NS_ERROR_FAILURE;

2
mozilla/extensions/wallet/src/nsWalletService.h
View File

@ -51,7 +51,7 @@ public:
nsWalletlibService();
// NS_DECL_NSIFORMSUBMITOBSERVER
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL);
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL, PRBool* cancelSubmit);
protected:
virtual ~nsWalletlibService();

4
mozilla/layout/html/forms/public/nsIFormSubmitObserver.h
View File

@ -54,9 +54,9 @@ public:
* NOTE: This is not necessarily the same window the form submit result
* will be loaded in (form could have target attribute set)
* @param actionURL- URL to which the form will be submitted.
* @param cancelSubmit- outparam - cancels form submit if set to true
*/
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL) = 0;
NS_IMETHOD Notify(nsIContent* formNode, nsIDOMWindowInternal* window, nsIURI* actionURL, PRBool* cancelSubmit) = 0;
};

19
mozilla/layout/html/forms/src/nsFormFrame.cpp
View File

@ -856,11 +856,11 @@ nsFormFrame::OnSubmit(nsIPresContext* aPresContext, nsIFrame* aFrame)
if (NS_FAILED(result)) return result;
nsString theTopic; theTopic.AssignWithConversion(NS_FORMSUBMIT_SUBJECT);
nsIEnumerator* theEnum;
result = service->EnumerateObserverList(theTopic.GetUnicode(), &theEnum);
nsCOMPtr<nsIEnumerator> theEnum;
result = service->EnumerateObserverList(theTopic.GetUnicode(), getter_AddRefs(theEnum));
if (NS_SUCCEEDED(result) && theEnum){
nsCOMPtr<nsISupports> inst;
nsresult submitStatus = NS_OK;
PRBool cancelSubmit = PR_FALSE;
nsCOMPtr<nsIScriptGlobalObject> globalObject;
document->GetScriptGlobalObject(getter_AddRefs(globalObject));
@ -871,16 +871,15 @@ nsFormFrame::OnSubmit(nsIPresContext* aPresContext, nsIFrame* aFrame)
if (NS_SUCCEEDED(result) && inst) {
nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver = do_QueryInterface(inst, &result);
if (NS_SUCCEEDED(result) && formSubmitObserver) {
nsresult notifyStatus = formSubmitObserver->Notify(mContent, window, actionURL);
if (NS_FAILED(notifyStatus)) {
submitStatus = notifyStatus;
nsresult notifyStatus = formSubmitObserver->Notify(mContent, window, actionURL, &cancelSubmit);
if (NS_FAILED(notifyStatus)) { // assert/warn if we get here?
return notifyStatus;
}
}
}
}
NS_RELEASE(theEnum);
if (NS_FAILED(submitStatus)) {
return submitStatus;
if (cancelSubmit) {
return NS_OK;
}
}
}