The algorithm https://html.spec.whatwg.org/#beginning-navigation takes
an optional Document-or-null, that we are currently not passing to our
implementation of this algorithm.
Navigation::Navigate is supposed to provide the document that is
navigating away as the source document, which would differ from the old
LocationBase::Navigate behavior, which always takes the incumbent global
document as the source document (just like spec says for Location).
This change makes it possible to provide the aSourceDocument.
Differential Revision: https://phabricator.services.mozilla.com/D274272
Make sure that navigations from Location and Window.open perform correct
conversion of history handling when passed "auto".
Differential Revision: https://phabricator.services.mozilla.com/D266519
Make sure that navigations from Location and Window.open perform correct
conversion of history handling when passed "auto".
Differential Revision: https://phabricator.services.mozilla.com/D266519
Make sure that navigations from Location and Window.open perform correct
conversion of history handling when passed "auto".
Differential Revision: https://phabricator.services.mozilla.com/D266519
Make sure that navigations from Location and Window.open perform correct
conversion of history handling when passed "auto".
Differential Revision: https://phabricator.services.mozilla.com/D266519
Most changes are automated. Relevant bit is dom/.clang-format. I had to
manually disable clang-format in a few places where importing external
files and so on that aren't self-contained, and fix a couple includes /
forward declarations.
Differential Revision: https://phabricator.services.mozilla.com/D256800
This patch copies the code from `LocationBase::SetURI()` and
`LocationBase::CheckURL()` into a new method called `NavigateNavigable()`.
The goal of this new method is to follow the spec
(https://html.spec.whatwg.org/#navigate) as close as possible.
This should be done in follow-up bugs.
Differential Revision: https://phabricator.services.mozilla.com/D249531
We are making changes to many files. Very huge chunk of the changes are just renaming CSP -> PolicyContainer. Part 1 and part 2 are solely separated as frontend and backend. The unfortunate thing is, I mistakenly placed IDL changes in part 1, and many of those IDL changes affect frontend code too. I'm sorry for this inconvinience and hard to review patch(es).
(FWIW before this rewrite we had another patch stack. It is 25 patches and I believe isn't as comprehensive as this one. It also didn't replace CSP's inheritance but was copied alongside with CSP, but we decided to change our method and make policy conttainer contain CSP and copy it around after some discussion and reviews)
Differential Revision: https://phabricator.services.mozilla.com/D249248
This patch copies the code from `LocationBase::SetURI()` and
`LocationBase::CheckURL()` into a new method called `NavigateNavigable()`.
The goal of this new method is to follow the spec
(https://html.spec.whatwg.org/#navigate) as close as possible.
This should be done in follow-up bugs.
Differential Revision: https://phabricator.services.mozilla.com/D249531
This reverts commit efd9a5ba48.
Revert "Bug 1968644 - Part 9: Add more tests for loads triggered by tracking scripts. r=valentin,anti-tracking-reviewers,emz"
This reverts commit 7d5c3e1c1c.
Revert "Bug 1968644 - Part 8: Populate the triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags for WebSocket requests. r=valentin,necko-reviewers"
This reverts commit 53a783a51e.
Revert "Bug 1968644 - Part 7: Add tests. r=necko-reviewers,anti-tracking-reviewers,emz,valentin"
This reverts commit e52f034955.
Revert "Bug 1968644 - Part 6: Populate triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags during channel creation. r=necko-reviewers,kershaw"
This reverts commit f564c21b37.
Revert "Bug 1968644 - Part 5: Populate triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags for CSS loads. r=emilio"
This reverts commit 8a8fd7bacc.
Revert "Bug 1968644 - Part 4: Populate triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags for loads. r=smaug,necko-reviewers"
This reverts commit 7b3ba3b668.
Revert "Bug 1968644 - Part 3: Populate the triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags for fetch requests. r=valentin,smaug"
This reverts commit 08f090244f.
Revert "Bug 1968644 - Part 2: Intorduce the ClassificationFlags to nsIClassifiedChannel.idl. r=dimi,necko-reviewers,valentin"
This reverts commit b8c01cd77c.
Revert "Bug 1968644 - Part 1: Introduce triggeringFirstPartyClassificationFlags and triggeringThirdPartyClassificationFlags to LoadInfo. r=necko-reviewers,kershaw"
This reverts commit a7619a72b4.
This commit is a prerequisite for part 5 of this patch set.
This flag is set in the docshell, based on `user gesture activation`.
This is not necessarily sufficient,
as the text fragments spec bases the value of
this flag also on User Involvement, which is not
implemented in Gecko yet.
The flag is then plumbed through the parent process
(`DocumentLoadListener::CreateDocumentLoadInfo()`)
to the document, where it can be consumed.
This includes client-side redirects as described in [0].
There is no changed behavior in this commit.
[0] https://wicg.github.io/scroll-to-text-fragment/#restricting-the-text-fragment
Differential Revision: https://phabricator.services.mozilla.com/D212817
This commit is a prerequisite for part 5 of this patch set.
This flag is set in the docshell, based on `user gesture activation`.
This is not necessarily sufficient,
as the text fragments spec bases the value of
this flag also on User Involvement, which is not
implemented in Gecko yet.
The flag is then plumbed through the parent process
(`DocumentLoadListener::CreateDocumentLoadInfo()`)
to the document, where it can be consumed.
This includes client-side redirects as described in [0].
There is no changed behavior in this commit.
[0] https://wicg.github.io/scroll-to-text-fragment/#restricting-the-text-fragment
Differential Revision: https://phabricator.services.mozilla.com/D212817
Minor correction from https://phabricator.services.mozilla.com/D184821.
The definition of "same-origin" used in that patch was that the iframe's origin after navigation is the same as the triggering principal.
This was incorrect.
Instead, the origin of the iframe before navigation should be the same as after navigation, which is the frame's document principal at the time this is called.
Also, I found places where I missed adding the new fields to the loadinfo: LocationBase and nsFrameLoader.
And I added the redirect tainting check and a missing nullcheck before calling SetTriggeringWindowId in nsDocShell.
Differential Revision: https://phabricator.services.mozilla.com/D190577
It's a security risk such that the maximized external program can obscure
the fullscreen notification and the malicious site can use this trick
to load a spoofed page in the background without user notices it.
This patch minimized the risk by always exit the fullscreen mode when
an external protocol is triggered.
Differential Revision: https://phabricator.services.mozilla.com/D177771
It's a security risk such that the maximized external program can obscure
the fullscreen notification and the malicious site can use this trick
to load a spoofed page in the background without user notices it.
This patch minimized the risk by always exit the fullscreen mode when
an external protocol is triggered.
Differential Revision: https://phabricator.services.mozilla.com/D177771
I don't think there's ever a way these should differ.
Got some include hell from removing ReferrerInfo.h from Document.h but
hopefully should be straight-forward to review.
Depends on D173154
Differential Revision: https://phabricator.services.mozilla.com/D173155
This makes the correlation between the method names and what they do
more clear, and adds an Entry variant for the entry global.
Depends on D166119
Differential Revision: https://phabricator.services.mozilla.com/D166207
Loads targeting cross-process BrowsingContexts are by definition cross-origin,
which should preclude any javascript: loads. While those loads are currently
prevented by principal checks in the final target process, sending IPC
messages for the attempts is unnecessary, and potentially opens a door to
privilege escalation exploits by a compromised content process.
This patch prevents any cross-process load requests from being sent by content
processes, and adds checks in the parent process to kill any (potentially
compromised) content process which attempts to send them.
Differential Revision: https://phabricator.services.mozilla.com/D103529
Loads targeting cross-process BrowsingContexts are by definition cross-origin,
which should preclude any javascript: loads. While those loads are currently
prevented by principal checks in the final target process, sending IPC
messages for the attempts is unnecessary, and potentially opens a door to
privilege escalation exploits by a compromised content process.
This patch prevents any cross-process load requests from being sent by content
processes, and adds checks in the parent process to kill any (potentially
compromised) content process which attempts to send them.
Differential Revision: https://phabricator.services.mozilla.com/D103529
Loads targeting cross-process BrowsingContexts are by definition cross-origin,
which should preclude any javascript: loads. While those loads are currently
prevented by principal checks in the final target process, sending IPC
messages for the attempts is unnecessary, and potentially opens a door to
privilege escalation exploits by a compromised content process.
This patch prevents any cross-process load requests from being sent by content
processes, and adds checks in the parent process to kill any (potentially
compromised) content process which attempts to send them.
Differential Revision: https://phabricator.services.mozilla.com/D103529
Loads targeting cross-process BrowsingContexts are by definition cross-origin,
which should preclude any javascript: loads. While those loads are currently
prevented by principal checks in the final target process, sending IPC
messages for the attempts is unnecessary, and potentially opens a door to
privilege escalation exploits by a compromised content process.
This patch prevents any cross-process load requests from being sent by content
processes, and adds checks in the parent process to kill any (potentially
compromised) content process which attempts to send them.
Differential Revision: https://phabricator.services.mozilla.com/D103529
This adds a rate limit to methods and setters of the History and Location
for non-system callers.
The rate limit is counted per BrowsingContext and can be controlled by prefs.
This patch is based on the original rate limit patch by :freesamael.
Differential Revision: https://phabricator.services.mozilla.com/D90136
Leo Tenenbaum