From 1409983d2d8bbae86e573e072fdc115f0762e74d Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 9 Jul 2020 13:01:36 +0000
Subject: [AppCache] Add check for disallowed encoded path separators

---
 uriloader/prefetch/nsOfflineCacheUpdate.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'uriloader')

diff --git a/uriloader/prefetch/nsOfflineCacheUpdate.cpp b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
index 4b6cd4d0c..8a4183429 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdate.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
@@ -948,6 +948,14 @@ nsOfflineManifestItem::HandleManifestLine(const nsCString::const_iterator &aBegi
                                     mStrictFileOriginPolicy))
             break;
 
+        // Check fallback path for disallowed encoded path separators
+        nsAutoCString path;
+        fallbackURI->GetFilePath(path);
+        if (path.Find("%2f") != kNotFound || path.Find("%2F") != kNotFound) {
+            LogToConsole("Offline cache manifest bad fallback path", this);
+            break;
+        }
+        
         mFallbackURIs.AppendObject(fallbackURI);
 
         AddNamespace(nsIApplicationCacheNamespace::NAMESPACE_FALLBACK,
-- 
cgit v1.2.3