Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move the safe vs unsafe about: distinction out of the security manager and into

Browse Source 
nsIAboutModule implementations.  Bug 337746, r=dveditz, sr=darin


git-svn-id: svn://10.0.0.236/trunk@200348 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzbarsky%mit.edu
2006-06-19 21:02:12 +00:00
parent f952ed05cf
commit dcd8a3a053
21 changed files with 556 additions and 242 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
mozilla/caps/src/nsScriptSecurityManager.cpp
View File

@@ -1201,25 +1201,6 @@ nsScriptSecurityManager::GetBaseURIScheme(nsIURI* aURI,
rv = uri->GetScheme(aScheme);
if (NS_FAILED(rv)) return rv;
//-- if aURI is an about uri, distinguish 'safe' and 'unsafe' about URIs
if(aScheme.EqualsLiteral("about"))
{
nsCAutoString path;
rv = NS_GetAboutModuleName(uri, path);
NS_ENSURE_SUCCESS(rv, rv);
if (path.EqualsLiteral("blank") ||
path.EqualsLiteral("mozilla") ||
path.EqualsLiteral("logo") ||
path.EqualsLiteral("license") ||
path.EqualsLiteral("licence") ||
path.EqualsLiteral("credits") ||
path.EqualsLiteral("neterror"))
{
aScheme = NS_LITERAL_CSTRING("about safe");
return NS_OK;
}
}
return NS_OK;
}
@@ -1334,8 +1315,8 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
{ "news", AllowProtocol },
{ "javascript", AllowProtocol },
{ "ftp", AllowProtocol },
{ "about safe", AllowProtocol },
{ "about", ChromeProtocol },
{ "moz-safe-about", AllowProtocol },
{ "about", DenyProtocol },
{ "mailto", AllowProtocol },
{ "aim", AllowProtocol },
{ "data", AllowProtocol },
@@ -1365,6 +1346,8 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
case PrefControlled:
{
// resource: and chrome: are equivalent, securitywise
// That's bogus!! Fix this. But watch out for
// the view-source stylesheet?
if (sourceScheme.EqualsLiteral("chrome") ||
sourceScheme.EqualsLiteral("resource"))
return NS_OK;
@@ -1390,6 +1373,8 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
if (aFlags & nsIScriptSecurityManager::ALLOW_CHROME)
return NS_OK;
// resource: and chrome: are equivalent, securitywise
// That's bogus!! Fix this. But watch out for
// the view-source stylesheet?
if (sourceScheme.EqualsLiteral("chrome") ||
sourceScheme.EqualsLiteral("resource"))
return NS_OK;