summaryrefslogtreecommitdiffstats
path: root/browser/base
diff options
context:
space:
mode:
Diffstat (limited to 'browser/base')
-rw-r--r--browser/base/content/browser-addons.js65
-rwxr-xr-xbrowser/base/content/browser.js83
-rw-r--r--browser/base/content/content.js6
-rw-r--r--browser/base/content/nsContextMenu.js5
-rw-r--r--browser/base/content/tabbrowser.xml6
-rw-r--r--browser/base/content/utilityOverlay.js22
6 files changed, 94 insertions, 93 deletions
diff --git a/browser/base/content/browser-addons.js b/browser/base/content/browser-addons.js
index 1f81d1fb0..1d881536a 100644
--- a/browser/base/content/browser-addons.js
+++ b/browser/base/content/browser-addons.js
@@ -459,15 +459,15 @@ var LightWeightThemeWebInstaller = {
switch (message.name) {
case "LightWeightThemeWebInstaller:Install": {
- this._installRequest(data.themeData, data.baseURI);
+ this._installRequest(data.themeData, data.principal, data.baseURI);
break;
}
case "LightWeightThemeWebInstaller:Preview": {
- this._preview(data.themeData, data.baseURI);
+ this._preview(data.themeData, data.principal, data.baseURI);
break;
}
case "LightWeightThemeWebInstaller:ResetPreview": {
- this._resetPreview(data && data.baseURI);
+ this._resetPreview(data && data.principal);
break;
}
}
@@ -489,33 +489,24 @@ var LightWeightThemeWebInstaller = {
return this._manager = temp.LightweightThemeManager;
},
- _installRequest: function (dataString, baseURI) {
+ _installRequest(dataString, principal, baseURI) {
+ // Don't allow installing off null principals.
+ if (!principal.URI) {
+ return;
+ }
+
let data = this._manager.parseTheme(dataString, baseURI);
if (!data) {
return;
}
- let uri = makeURI(baseURI);
-
// A notification bar with the option to undo is normally shown after a
// theme is installed. But the discovery pane served from the url(s)
// below has its own toggle switch for quick undos, so don't show the
// notification in that case.
- let notify = uri.prePath != "https://discovery.addons.mozilla.org";
- if (notify) {
- try {
- if (Services.prefs.getBoolPref("extensions.webapi.testing")
- && (uri.prePath == "https://discovery.addons.allizom.org"
- || uri.prePath == "https://discovery.addons-dev.allizom.org")) {
- notify = false;
- }
- } catch (e) {
- // getBoolPref() throws if the testing pref isn't set. ignore it.
- }
- }
-
- if (this._isAllowed(baseURI)) {
+ let notify = this._shouldShowUndoPrompt(principal);
+ if (this._isAllowed(principal)) {
this._install(data, notify);
return;
}
@@ -526,7 +517,7 @@ var LightWeightThemeWebInstaller = {
gNavigatorBundle.getString("lwthemeInstallRequest.allowButton.accesskey");
let message =
gNavigatorBundle.getFormattedString("lwthemeInstallRequest.message",
- [uri.host]);
+ [principal.URI.host]);
let buttons = [{
label: allowButtonText,
accessKey: allowButtonAccesskey,
@@ -629,8 +620,8 @@ var LightWeightThemeWebInstaller = {
});
},
- _preview: function (dataString, baseURI) {
- if (!this._isAllowed(baseURI))
+ _preview(dataString, principal, baseURI) {
+ if (!this._isAllowed(principal))
return;
let data = this._manager.parseTheme(dataString, baseURI);
@@ -642,29 +633,33 @@ var LightWeightThemeWebInstaller = {
this._manager.previewTheme(data);
},
- _resetPreview: function (baseURI) {
- if (baseURI && !this._isAllowed(baseURI))
+ _resetPreview(principal) {
+ if (!this._isAllowed(principal))
return;
gBrowser.tabContainer.removeEventListener("TabSelect", this, false);
this._manager.resetPreview();
},
- _isAllowed: function (srcURIString) {
- let uri;
- try {
- uri = makeURI(srcURIString);
- }
- catch (e) {
- // makeURI fails if srcURIString is a nonsense URI
+ _isAllowed(principal) {
+ if (!principal || !principal.URI || !principal.URI.schemeIs("https")) {
return false;
}
- if (!uri.schemeIs("https")) {
+ let pm = Services.perms;
+ return pm.testPermission(principal.URI, "install") == pm.ALLOW_ACTION;
+ },
+
+ _shouldShowUndoPrompt(principal) {
+ if (!principal || !principal.URI) {
+ return true;
+ }
+
+ let prePath = principal.URI.prePath;
+ if (prePath == "https://addons.palemoon.org") {
return false;
}
- let pm = Services.perms;
- return pm.testPermission(uri, "install") == pm.ALLOW_ACTION;
+ return true;
}
};
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 696a2871a..2380f5d21 100755
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -71,6 +71,10 @@ XPCOMUtils.defineLazyModuleGetter(this, "SafeBrowsing",
["gDNSService", "@mozilla.org/network/dns-service;1", "nsIDNSService"],
].forEach(([name, cc, ci]) => XPCOMUtils.defineLazyServiceGetter(this, name, cc, ci));
+XPCOMUtils.defineLazyServiceGetter(this, "gSerializationHelper",
+ "@mozilla.org/network/serialization-helper;1",
+ "nsISerializationHelper");
+
XPCOMUtils.defineLazyGetter(this, "BrowserToolboxProcess", function() {
let tmp = {};
Cu.import("resource://devtools/client/framework/ToolboxProcess.jsm", tmp);
@@ -807,6 +811,7 @@ function _loadURIWithFlags(browser, uri, params) {
if (!uri) {
uri = "about:blank";
}
+ let triggeringPrincipal = params.triggeringPrincipal || null;
let flags = params.flags || 0;
let referrer = params.referrerURI;
let referrerPolicy = ('referrerPolicy' in params ? params.referrerPolicy :
@@ -831,7 +836,7 @@ function _loadURIWithFlags(browser, uri, params) {
browser.webNavigation.loadURIWithOptions(uri, flags,
referrer, referrerPolicy,
- postData, null, null);
+ postData, null, null, triggeringPrincipal);
} else {
// Check if the current browser is allowed to unload.
let {permitUnload, timedOut} = browser.permitUnload();
@@ -845,6 +850,9 @@ function _loadURIWithFlags(browser, uri, params) {
let loadParams = {
uri: uri,
+ triggeringPrincipal: triggeringPrincipal
+ ? gSerializationHelper.serializeToString(triggeringPrincipal)
+ : null,
flags: flags,
referrer: referrer ? referrer.spec : null,
referrerPolicy: referrerPolicy,
@@ -872,7 +880,7 @@ function _loadURIWithFlags(browser, uri, params) {
}
browser.webNavigation.loadURIWithOptions(uri, flags, referrer, referrerPolicy,
- postData, null, null);
+ postData, null, null, triggeringPrincipal);
} else {
throw e;
}
@@ -1164,6 +1172,7 @@ var gBrowserInit = {
// [5]: referrerPolicy (int)
// [6]: userContextId (int)
// [7]: originPrincipal (nsIPrincipal)
+ // [8]: triggeringPrincipal (nsIPrincipal)
else if (window.arguments.length >= 3) {
let referrerURI = window.arguments[2];
if (typeof(referrerURI) == "string") {
@@ -1181,7 +1190,7 @@ var gBrowserInit = {
window.arguments[4] || false, referrerPolicy, userContextId,
// pass the origin principal (if any) and force its use to create
// an initial about:blank viewer if present:
- window.arguments[7], !!window.arguments[7]);
+ window.arguments[7], !!window.arguments[7], window.arguments[8]);
window.focus();
}
// Note: loadOneOrMoreURIs *must not* be called if window.arguments.length >= 3.
@@ -2067,7 +2076,8 @@ function BrowserTryToCloseWindow()
}
function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
- userContextId, originPrincipal, forceAboutBlankViewerInCurrent) {
+ userContextId, originPrincipal, forceAboutBlankViewerInCurrent,
+ triggeringPrincipal) {
try {
openLinkIn(uri, "current",
{ referrerURI: referrer,
@@ -2076,6 +2086,7 @@ function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
allowThirdPartyFixup: allowThirdPartyFixup,
userContextId: userContextId,
originPrincipal,
+ triggeringPrincipal,
forceAboutBlankViewerInCurrent,
});
} catch (e) {}
@@ -2779,24 +2790,6 @@ var BrowserOnClick = {
}
},
- handleEvent: function (event) {
- if (!event.isTrusted || // Don't trust synthetic events
- event.button == 2) {
- return;
- }
-
- let originalTarget = event.originalTarget;
- let ownerDoc = originalTarget.ownerDocument;
- if (!ownerDoc) {
- return;
- }
-
- if (gMultiProcessBrowser &&
- ownerDoc.documentURI.toLowerCase() == "about:newtab") {
- this.onE10sAboutNewTab(event, ownerDoc);
- }
- },
-
receiveMessage: function (msg) {
switch (msg.name) {
case "Browser:CertExceptionError":
@@ -2990,28 +2983,6 @@ var BrowserOnClick = {
}
},
- /**
- * This functions prevents navigation from happening directly through the <a>
- * link in about:newtab (which is loaded in the parent and therefore would load
- * the next page also in the parent) and instructs the browser to open the url
- * in the current tab which will make it update the remoteness of the tab.
- */
- onE10sAboutNewTab: function(event, ownerDoc) {
- let isTopFrame = (ownerDoc.defaultView.parent === ownerDoc.defaultView);
- if (!isTopFrame) {
- return;
- }
-
- let anchorTarget = event.originalTarget.parentNode;
-
- if (anchorTarget instanceof HTMLAnchorElement &&
- anchorTarget.classList.contains("newtab-link")) {
- event.preventDefault();
- let where = whereToOpenLink(event, false, false);
- openLinkIn(anchorTarget.href, where, { charset: ownerDoc.characterSet, referrerURI: ownerDoc.documentURIObject });
- }
- },
-
ignoreWarningButton: function (reason) {
// Allow users to override and continue through to the site,
// but add a notify bar as a reminder, so that they don't lose
@@ -4809,13 +4780,9 @@ var TabsProgressListener = {
}
}
- // Attach a listener to watch for "click" events bubbling up from error
- // pages and other similar pages (like about:newtab). This lets us fix bugs
- // like 401575 which require error page UI to do privileged things, without
- // letting error pages have any privilege themselves.
- // We can't look for this during onLocationChange since at that point the
- // document URI is not yet the about:-uri of the error page.
-
+ // We used to listen for clicks in the browser here, but when that
+ // became unnecessary, removing the code below caused focus issues.
+ // This code should be removed. Tracked in bug 1337794.
let isRemoteBrowser = aBrowser.isRemoteBrowser;
// We check isRemoteBrowser here to avoid requesting the doc CPOW
let doc = isRemoteBrowser ? null : aWebProgress.DOMWindow.document;
@@ -4830,11 +4797,9 @@ var TabsProgressListener = {
// STATE_STOP may be received twice for documents, thus store an
// attribute to ensure handling it just once.
doc.documentElement.setAttribute("hasBrowserHandlers", "true");
- aBrowser.addEventListener("click", BrowserOnClick, true);
aBrowser.addEventListener("pagehide", function onPageHide(event) {
if (event.target.defaultView.frameElement)
return;
- aBrowser.removeEventListener("click", BrowserOnClick, true);
aBrowser.removeEventListener("pagehide", onPageHide, true);
if (event.target.documentElement)
event.target.documentElement.removeAttribute("hasBrowserHandlers");
@@ -4883,7 +4848,7 @@ nsBrowserAccess.prototype = {
_openURIInNewTab: function(aURI, aReferrer, aReferrerPolicy, aIsPrivate,
aIsExternal, aForceNotRemote=false,
aUserContextId=Ci.nsIScriptSecurityManager.DEFAULT_USER_CONTEXT_ID,
- aOpener=null) {
+ aOpener = null, aTriggeringPrincipal = null) {
let win, needToFocusWin;
// try the current window. if we're in a popup, fall back on the most recent browser window
@@ -4908,6 +4873,7 @@ nsBrowserAccess.prototype = {
let loadInBackground = gPrefService.getBoolPref("browser.tabs.loadDivertedInBackground");
let tab = win.gBrowser.loadOneTab(aURI ? aURI.spec : "about:blank", {
+ triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aReferrer,
referrerPolicy: aReferrerPolicy,
userContextId: aUserContextId,
@@ -4956,9 +4922,11 @@ nsBrowserAccess.prototype = {
}
let referrer = aOpener ? makeURI(aOpener.location.href) : null;
+ let triggeringPrincipal = null;
let referrerPolicy = Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT;
if (aOpener && aOpener.document) {
referrerPolicy = aOpener.document.referrerPolicy;
+ triggeringPrincipal = aOpener.document.nodePrincipal;
}
let isPrivate = aOpener
? PrivateBrowsingUtils.isContentWindowPrivate(aOpener)
@@ -4992,7 +4960,7 @@ nsBrowserAccess.prototype = {
let browser = this._openURIInNewTab(aURI, referrer, referrerPolicy,
isPrivate, isExternal,
forceNotRemote, userContextId,
- openerWindow);
+ openerWindow, triggeringPrincipal);
if (browser)
newWindow = browser.contentWindow;
break;
@@ -5003,6 +4971,7 @@ nsBrowserAccess.prototype = {
Ci.nsIWebNavigation.LOAD_FLAGS_FROM_EXTERNAL :
Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
gBrowser.loadURIWithFlags(aURI.spec, {
+ triggeringPrincipal,
flags: loadflags,
referrerURI: referrer,
referrerPolicy: referrerPolicy,
@@ -5031,7 +5000,8 @@ nsBrowserAccess.prototype = {
aParams.referrerPolicy,
aParams.isPrivate,
isExternal, false,
- userContextId);
+ userContextId, null,
+ aParams.triggeringPrincipal);
if (browser)
return browser.QueryInterface(Ci.nsIFrameLoaderOwner);
@@ -5584,6 +5554,7 @@ function handleLinkClick(event, href, linkNode) {
referrerPolicy: referrerPolicy,
noReferrer: BrowserUtils.linkHasNoReferrer(linkNode),
originPrincipal: doc.nodePrincipal,
+ triggeringPrincipal: doc.nodePrincipal,
};
// The new tab/window must use the same userContextId
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 8d6f0745e..496e0d111 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -482,6 +482,7 @@ var ClickEventHandler = {
ctrlKey: event.ctrlKey, metaKey: event.metaKey,
altKey: event.altKey, href: null, title: null,
bookmark: false, referrerPolicy: referrerPolicy,
+ triggeringPrincipal: principal,
originAttributes: principal ? principal.originAttributes : {},
isContentWindowPrivate: PrivateBrowsingUtils.isContentWindowPrivate(ownerDoc.defaultView)};
@@ -521,6 +522,7 @@ var ClickEventHandler = {
} catch (e) {}
}
json.originPrincipal = ownerDoc.nodePrincipal;
+ json.triggeringPrincipal = ownerDoc.nodePrincipal;
sendAsyncMessage("Content:Click", json);
return;
@@ -894,6 +896,7 @@ var LightWeightThemeWebInstallListener = {
case "InstallBrowserTheme": {
sendAsyncMessage("LightWeightThemeWebInstaller:Install", {
baseURI: event.target.baseURI,
+ principal: event.target.nodePrincipal,
themeData: event.target.getAttribute("data-browsertheme"),
});
break;
@@ -901,6 +904,7 @@ var LightWeightThemeWebInstallListener = {
case "PreviewBrowserTheme": {
sendAsyncMessage("LightWeightThemeWebInstaller:Preview", {
baseURI: event.target.baseURI,
+ principal: event.target.nodePrincipal,
themeData: event.target.getAttribute("data-browsertheme"),
});
this._previewWindow = event.target.ownerGlobal;
@@ -915,7 +919,7 @@ var LightWeightThemeWebInstallListener = {
case "ResetBrowserThemePreview": {
if (this._previewWindow) {
sendAsyncMessage("LightWeightThemeWebInstaller:ResetPreview",
- {baseURI: event.target.baseURI});
+ {principal: event.target.nodePrincipal});
this._resetPreviewWindow();
}
break;
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index ddf695202..955184f64 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -968,6 +968,7 @@ nsContextMenu.prototype = {
_openLinkInParameters : function (extra) {
let params = { charset: gContextMenuContentData.charSet,
originPrincipal: this.principal,
+ triggeringPrincipal: this.principal,
referrerURI: gContextMenuContentData.documentURIObject,
referrerPolicy: gContextMenuContentData.referrerPolicy,
noReferrer: this.linkHasNoReferrer };
@@ -1147,10 +1148,12 @@ nsContextMenu.prototype = {
// Change current window to the URL of the image, video, or audio.
viewMedia: function(e) {
let referrerURI = gContextMenuContentData.documentURIObject;
+ let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
if (this.onCanvas) {
this._canvasToBlobURL(this.target).then(function(blobURL) {
openUILink(blobURL, e, { disallowInheritPrincipal: true,
- referrerURI: referrerURI });
+ referrerURI: referrerURI,
+ triggeringPrincipal: systemPrincipal});
}, Cu.reportError);
}
else {
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index b27846835..463e74a52 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1513,6 +1513,7 @@
<parameter name="aAllowThirdPartyFixup"/>
<body>
<![CDATA[
+ var aTriggeringPrincipal;
var aReferrerPolicy;
var aFromExternal;
var aRelatedToCurrent;
@@ -1528,6 +1529,7 @@
typeof arguments[1] == "object" &&
!(arguments[1] instanceof Ci.nsIURI)) {
let params = arguments[1];
+ aTriggeringPrincipal = params.triggeringPrincipal
aReferrerURI = params.referrerURI;
aReferrerPolicy = params.referrerPolicy;
aCharset = params.charset;
@@ -1550,6 +1552,7 @@
Services.prefs.getBoolPref("browser.tabs.loadInBackground");
var owner = bgLoad ? null : this.selectedTab;
var tab = this.addTab(aURI, {
+ triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aReferrerURI,
referrerPolicy: aReferrerPolicy,
charset: aCharset,
@@ -2120,6 +2123,7 @@
"use strict";
const NS_XUL = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+ var aTriggeringPrincipal;
var aReferrerPolicy;
var aFromExternal;
var aRelatedToCurrent;
@@ -2136,6 +2140,7 @@
typeof arguments[1] == "object" &&
!(arguments[1] instanceof Ci.nsIURI)) {
let params = arguments[1];
+ aTriggeringPrincipal = params.triggeringPrincipal;
aReferrerURI = params.referrerURI;
aReferrerPolicy = params.referrerPolicy;
aCharset = params.charset;
@@ -2267,6 +2272,7 @@
try {
b.loadURIWithFlags(aURI, {
flags,
+ triggeringPrincipal: aTriggeringPrincipal,
referrerURI: aNoReferrer ? null: aReferrerURI,
referrerPolicy: aReferrerPolicy,
charset: aCharset,
diff --git a/browser/base/content/utilityOverlay.js b/browser/base/content/utilityOverlay.js
index 6ceaf773e..b041915a7 100644
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -225,6 +225,7 @@ function openLinkIn(url, where, params) {
var aUserContextId = params.userContextId;
var aIndicateErrorPageLoad = params.indicateErrorPageLoad;
var aPrincipal = params.originPrincipal;
+ var aTriggeringPrincipal = params.triggeringPrincipal;
var aForceAboutBlankViewerInCurrent =
params.forceAboutBlankViewerInCurrent;
@@ -259,6 +260,24 @@ function openLinkIn(url, where, params) {
return;
}
+ // Teach the principal about the right OA to use, e.g. in case when
+ // opening a link in a new private window, or in a new container tab.
+ // Please note we do not have to do that for SystemPrincipals and we
+ // can not do it for NullPrincipals since NullPrincipals are only
+ // identical if they actually are the same object (See Bug: 1346759)
+ function useOAForPrincipal(principal) {
+ if (principal && principal.isCodebasePrincipal) {
+ let attrs = {
+ userContextId: aUserContextId,
+ privateBrowsingId: aIsPrivate || (w && PrivateBrowsingUtils.isWindowPrivate(w)),
+ };
+ return Services.scriptSecurityManager.createCodebasePrincipal(principal.URI, attrs);
+ }
+ return principal;
+ }
+ aPrincipal = useOAForPrincipal(aPrincipal);
+ aTriggeringPrincipal = useOAForPrincipal(aTriggeringPrincipal);
+
if (!w || where == "window") {
// Strip referrer data when opening a new private window, to prevent
// regular browsing data from leaking into it.
@@ -308,6 +327,7 @@ function openLinkIn(url, where, params) {
sa.appendElement(referrerPolicySupports, /* weak =*/ false);
sa.appendElement(userContextIdSupports, /* weak =*/ false);
sa.appendElement(aPrincipal, /* weak =*/ false);
+ sa.appendElement(aTriggeringPrincipal, /* weak =*/ false);
let features = "chrome,dialog=no,all";
if (aIsPrivate) {
@@ -394,6 +414,7 @@ function openLinkIn(url, where, params) {
}
aCurrentBrowser.loadURIWithFlags(url, {
+ triggeringPrincipal: aTriggeringPrincipal,
flags: flags,
referrerURI: aNoReferrer ? null : aReferrerURI,
referrerPolicy: aReferrerPolicy,
@@ -419,6 +440,7 @@ function openLinkIn(url, where, params) {
noReferrer: aNoReferrer,
userContextId: aUserContextId,
originPrincipal: aPrincipal,
+ triggeringPrincipal: aTriggeringPrincipal,
});
browserUsedForLoad = tabUsedForLoad.linkedBrowser;
break;
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-12 18:14:01 +0000