Bug 1184387 - Bail out of file:// loads for all non-chrome:// URIs. r=Gijs, a=ritu
authorBobby Holley <bobbyholley@gmail.com>
Tue, 04 Aug 2015 10:42:40 -0700
changeset 282043 5abf8bfc1c179521d8fefd224a54502e76f0adec
parent 282042 d80a3d669b40568d3286b960d7030dcf8b0e606c
child 282044 71e2835e9d2295a812ae118b5e47bceaff2ba4ad
push id4995
push userbobbyholley@gmail.com
push dateWed, 26 Aug 2015 19:20:53 +0000
treeherdermozilla-beta@5abf8bfc1c17 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersGijs, ritu
bugs1184387
milestone41.0
Bug 1184387 - Bail out of file:// loads for all non-chrome:// URIs. r=Gijs, a=ritu try: -b do -p linux,linux64 -u all -t none
caps/nsScriptSecurityManager.cpp
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -802,28 +802,22 @@ nsScriptSecurityManager::CheckLoadURIWit
         // Allow domains that were whitelisted in the prefs. In 99.9% of cases,
         // this array is empty.
         for (size_t i = 0; i < mFileURIWhitelist.Length(); ++i) {
             if (EqualOrSubdomain(sourceURI, mFileURIWhitelist[i])) {
                 return NS_OK;
             }
         }
 
-        // resource: and chrome: are equivalent, securitywise
-        // That's bogus!!  Fix this.  But watch out for
-        // the view-source stylesheet?
-        bool sourceIsChrome;
-        rv = NS_URIChainHasFlags(sourceURI,
-                                 nsIProtocolHandler::URI_IS_UI_RESOURCE,
-                                 &sourceIsChrome);
-        NS_ENSURE_SUCCESS(rv, rv);
-        if (sourceIsChrome) {
+        // Allow chrome://
+        if (sourceScheme.EqualsLiteral("chrome")) {
             return NS_OK;
         }
 
+        // Nothing else.
         if (reportErrors) {
             ReportError(nullptr, errorTag, sourceURI, aTargetURI);
         }
         return NS_ERROR_DOM_BAD_URI;
     }
 
     // OK, everyone is allowed to load this, since unflagged handlers are
     // deprecated but treated as URI_LOADABLE_BY_ANYONE.  But check whether we