Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-28 13:21:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixing bug 250862. Prevent javascript: and data: URLs from being dropped into the content area. r=caillon@gmail.com, sr=dveditz@cruzio.com

Browse Source
This commit is contained in:
jst%mozilla.jstenback.com 2004-08-26 07:47:38 +00:00
parent e8a062aa61
commit 1238616f0a
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
browser/base/content/browser.js
View File

@ -4132,8 +4132,11 @@ var contentAreaDNDObserver = {
{
var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType);
// valid urls don't contain spaces ' '; if we have a space it isn't a valid url so bail out
if (!url || !url.length || url.indexOf(" ", 0) != -1)
// valid urls don't contain spaces ' '; if we have a space it
// isn't a valid url, or if it's a javascript: or data: url,
// bail out
if (!url || !url.length || url.indexOf(" ", 0) != -1 ||
/^\s*(javascript|data):/.test(url))
return;
switch (document.firstChild.getAttribute('windowtype')) {

7
xpfe/communicator/resources/content/contentAreaDD.js
View File

@ -53,8 +53,11 @@ var contentAreaDNDObserver = {
{
var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType);
// valid urls don't contain spaces ' '; if we have a space it isn't a valid url so bail out
if (!url || !url.length || url.indexOf(" ", 0) != -1)
// valid urls don't contain spaces ' '; if we have a space it
// isn't a valid url, or if it's a javascript: or data: url,
// bail out
if (!url || !url.length || url.indexOf(" ", 0) != -1 ||
/^\s*(javascript|data):/.test(url))
return;
switch (document.firstChild.getAttribute('windowtype')) {