Bug 1329822 - file:// documents can't use <a download=foo.txt> to set a download name/force a download; r=baku,Gijs
authorHaik Aftandilian <haftandilian@mozilla.com>
Fri, 13 Jan 2017 11:55:38 -0800
changeset 468817 9cecb0eb3c5bc74afdc8e1c88034689c727f83f5
parent 468816 5e502d481d6caba51c7ee9852de43da5ec8a233e
child 468818 1789e79681dd6ad7c72330850c0b05f2e2b48a41
push id43551
push userbmo:kgilbert@mozilla.com
push dateTue, 31 Jan 2017 23:27:06 +0000
reviewersbaku, Gijs
bugs1329822
milestone54.0a1
Bug 1329822 - file:// documents can't use <a download=foo.txt> to set a download name/force a download; r=baku,Gijs MozReview-Commit-ID: 9cRepRafhWO
browser/modules/E10SUtils.jsm
--- a/browser/modules/E10SUtils.jsm
+++ b/browser/modules/E10SUtils.jsm
@@ -66,19 +66,21 @@ this.E10SUtils = {
       aURL = "about:blank";
     }
 
     // Javascript urls can load in any process, they apply to the current document
     if (aURL.startsWith("javascript:")) {
       return aPreferredRemoteType;
     }
 
-    // We need data: URIs to load in any remote process, because some of our
-    // tests rely on this.
-    if (aURL.startsWith("data:")) {
+    // We need data: URI's to load in a remote process, because some of our
+    // tests rely on this. For blob: URI's, load them in their originating
+    // process unless it is non-remote. In that case, favor a remote (sandboxed)
+    // process with fewer privileges to limit exposure.
+    if (aURL.startsWith("data:") || aURL.startsWith("blob:")) {
       return aPreferredRemoteType == NOT_REMOTE ? DEFAULT_REMOTE_TYPE
                                                 : aPreferredRemoteType;
     }
 
     if (aURL.startsWith("file:")) {
       return Services.prefs.getBoolPref("browser.tabs.remote.separateFileUriProcess")
              ? FILE_REMOTE_TYPE : DEFAULT_REMOTE_TYPE;
     }