Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug 415338 (follow-on to bug 413250) don't scan query parts of chrome URIs to not break addons (as inspired by similar Seamonkey regression) . r/sr=neil, a=mtscrehp

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@244794 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
dveditz%cruzio.com
2008-02-02 19:50:09 +00:00
parent 27ef487bc1
commit c383f0b3e5
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
mozilla/chrome/src/nsChromeRegistry.cpp
View File

@@ -681,24 +681,29 @@ nsChromeRegistry::Canonify(nsIURL* aChromeURL)
else {
// prevent directory traversals ("..")
// path is already unescaped once, but uris can get unescaped twice
const char* curChar = path.BeginReading();
const char* pos = path.BeginReading();
const char* end = path.EndReading();
while (curChar < end) {
switch (*curChar) {
while (pos < end) {
switch (*pos) {
case ':':
return NS_ERROR_DOM_BAD_URI;
case '.':
if (*(curChar+1) == '.')
if (pos[1] == '.')
return NS_ERROR_DOM_BAD_URI;
break;
case '%':
// chrome: URIs with double-escapes are trying to trick us.
// watch for %2e, and %25 in case someone triple unescapes
if (*(curChar+1) == '2' &&
( *(curChar+2) == 'e' || *(curChar+2) == 'E' ||
*(curChar+2) == '5' ))
if (pos[1] == '2' &&
( pos[2] == 'e' || pos[2] == 'E' ||
pos[2] == '5' ))
return NS_ERROR_DOM_BAD_URI;
break;
case '?':
pos = end;
continue;
}
++curChar;
++pos;
}
}