Bug 1409458 - use new document and importNode() to avoid loading of blocked images in attachment keyword check. r=bz,aceman
authorJorg K <jorgk@jorgk.com>
Thu, 30 Nov 2017 00:03:17 +0100
changeset 22785 5389c3dc10db277e79d8a86f8b682b4c3aaf7be2
parent 22784 9ce6d19a9dcadcff950c64506d0ca9a834f003f4
child 22786 1c1e48b383bd2eef370210381f3a037785d0b85d
push id13803
push usermozilla@jorgk.com
push dateWed, 29 Nov 2017 23:09:22 +0000
treeherdercomm-central@1654a1adc838 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, aceman
bugs1409458
Bug 1409458 - use new document and importNode() to avoid loading of blocked images in attachment keyword check. r=bz,aceman
mail/components/compose/content/MsgComposeCommands.js
--- a/mail/components/compose/content/MsgComposeCommands.js
+++ b/mail/components/compose/content/MsgComposeCommands.js
@@ -6005,17 +6005,22 @@ var gAttachmentNotifier =
       attachmentWorker.lastMessage = null;
       return (async ? null : []);
     }
 
     let keywordsInCsv = Services.prefs.getComplexValue(
       "mail.compose.attachment_reminder_keywords",
       Components.interfaces.nsIPrefLocalizedString).data;
     let mailBody = getBrowser().contentDocument.querySelector("body");
-    let mailBodyNode = mailBody.cloneNode(true);
+
+    // We use a new document and import the body into it. We do that to avoid
+    // loading images that were previously blocked. Content policy of the newly
+    // created data document will block the loads. Details: Bug 1409458 comment #22.
+    let newDoc = getBrowser().contentDocument.implementation.createDocument("", "", null);
+    let mailBodyNode = newDoc.importNode(mailBody, true);
 
     // Don't check quoted text from reply.
     let blockquotes = mailBodyNode.getElementsByTagName("blockquote");
     for (let i = blockquotes.length - 1; i >= 0; i--) {
       blockquotes[i].remove();
     }
 
     // For plaintext composition the quotes we need to find and exclude are