From a7acf6eb90286879f58033cef7d159e2116a95ff Mon Sep 17 00:00:00 2001 From: "jst%mozilla.jstenback.com" Date: Thu, 26 Aug 2004 07:47:38 +0000 Subject: [PATCH] Fixing bug 250862. Prevent javascript: and data: URLs from being dropped into the content area. r=caillon@gmail.com, sr=dveditz@cruzio.com git-svn-id: svn://10.0.0.236/trunk@161307 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/browser/base/content/browser.js | 7 +++++-- .../xpfe/communicator/resources/content/contentAreaDD.js | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/mozilla/browser/base/content/browser.js b/mozilla/browser/base/content/browser.js index 0386ca9353f..cb107001844 100644 --- a/mozilla/browser/base/content/browser.js +++ b/mozilla/browser/base/content/browser.js @@ -4132,8 +4132,11 @@ var contentAreaDNDObserver = { { var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType); - // valid urls don't contain spaces ' '; if we have a space it isn't a valid url so bail out - if (!url || !url.length || url.indexOf(" ", 0) != -1) + // valid urls don't contain spaces ' '; if we have a space it + // isn't a valid url, or if it's a javascript: or data: url, + // bail out + if (!url || !url.length || url.indexOf(" ", 0) != -1 || + /^\s*(javascript|data):/.test(url)) return; switch (document.firstChild.getAttribute('windowtype')) { diff --git a/mozilla/xpfe/communicator/resources/content/contentAreaDD.js b/mozilla/xpfe/communicator/resources/content/contentAreaDD.js index a741aacecd8..7ecd499267b 100644 --- a/mozilla/xpfe/communicator/resources/content/contentAreaDD.js +++ b/mozilla/xpfe/communicator/resources/content/contentAreaDD.js @@ -53,8 +53,11 @@ var contentAreaDNDObserver = { { var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType); - // valid urls don't contain spaces ' '; if we have a space it isn't a valid url so bail out - if (!url || !url.length || url.indexOf(" ", 0) != -1) + // valid urls don't contain spaces ' '; if we have a space it + // isn't a valid url, or if it's a javascript: or data: url, + // bail out + if (!url || !url.length || url.indexOf(" ", 0) != -1 || + /^\s*(javascript|data):/.test(url)) return; switch (document.firstChild.getAttribute('windowtype')) {