Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-23 21:01:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1507702 - Don't make about:crash* accessible to web content r=Ehsan,bzbarsky

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D12133
This commit is contained in:
James Willcox 2018-11-29 08:35:07 -06:00
parent 1ec332e1cb
commit c010fd41c0
3 changed files with 93 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
docshell/base/nsAboutRedirector.cpp
View File

@ -7,6 +7,7 @@
#include "nsAboutRedirector.h"
#include "nsNetUtil.h"
#include "nsAboutProtocolUtils.h"
#include "nsBaseChannel.h"
#include "mozilla/ArrayUtils.h"
#include "nsIProtocolHandler.h"
@ -27,6 +28,36 @@ struct RedirEntry
uint32_t flags;
};
class CrashChannel final : public nsBaseChannel
{
public:
explicit CrashChannel(nsIURI* aURI)
{
SetURI(aURI);
}
nsresult OpenContentStream(bool async, nsIInputStream **stream,
nsIChannel** channel) override
{
nsAutoCString spec;
mURI->GetSpec(spec);
if (spec.EqualsASCII("about:crashparent") && XRE_IsParentProcess()) {
MOZ_CRASH("Crash via about:crashparent");
}
if (spec.EqualsASCII("about:crashcontent") && XRE_IsContentProcess()) {
MOZ_CRASH("Crash via about:crashcontent");
}
NS_WARNING("Unhandled about:crash* URI or wrong process");
return NS_ERROR_NOT_IMPLEMENTED;
}
protected:
virtual ~CrashChannel() = default;
};
/*
Entries which do not have URI_SAFE_FOR_UNTRUSTED_CONTENT will run with chrome
privileges. This is potentially dangerous. Please use
@ -145,12 +176,10 @@ static const RedirEntry kRedirMap[] = {
},
{
"crashparent", "about:blank",
nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
nsIAboutModule::HIDE_FROM_ABOUTABOUT
},
{
"crashcontent", "about:blank",
nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
nsIAboutModule::HIDE_FROM_ABOUTABOUT |
nsIAboutModule::URI_CAN_LOAD_IN_CHILD |
nsIAboutModule::URI_MUST_LOAD_IN_CHILD
@ -174,12 +203,10 @@ nsAboutRedirector::NewChannel(nsIURI* aURI,
nsCOMPtr<nsIIOService> ioService = do_GetIOService(&rv);
NS_ENSURE_SUCCESS(rv, rv);
if (XRE_IsParentProcess() && path.EqualsASCII("crashparent")) {
MOZ_CRASH("Crash via about:crashparent");
}
if (XRE_IsContentProcess() && path.EqualsASCII("crashcontent")) {
MOZ_CRASH("Crash via about:crashcontent");
if (path.EqualsASCII("crashparent") || path.EqualsASCII("crashcontent")) {
nsCOMPtr<nsIChannel> channel = new CrashChannel(aURI);
channel.forget(aResult);
return NS_OK;
}
#ifdef ABOUT_CONFIG_BLOCKED_GV

1
docshell/test/mochitest/mochitest.ini
View File

@ -115,3 +115,4 @@ support-files = file_framedhistoryframes.html
[test_pushState_after_document_open.html]
[test_windowedhistoryframes.html]
[test_triggeringprincipal_location_seturi.html]
[test_bug1507702.html]

57
docshell/test/mochitest/test_bug1507702.html Normal file
View File

@ -0,0 +1,57 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=1507702
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 1507702</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<link rel="icon" href="about:crashparent"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1507702">Mozilla Bug 1507702</a>
<img src="about:crashparent">
<img src="about:crashcontent">
<iframe src="about:crashparent"></iframe>
<iframe src="about:crashcontent"></iframe>
<script>
let urls = ["about:crashparent", "about:crashcontent"];
async function testFetch() {
const url = urls.shift();
if (!url) {
return Promise.resolve();
}
let threw;
try {
await fetch(url);
threw = false;
} catch (e) {
threw = true;
};
ok(threw === true, "fetch should reject");
return testFetch();
}
document.body.onload = async () => {
for (const url of ["about:crashparent", "about:crashcontent"]) {
SimpleTest.doesThrow(() => {
top.location.href = url;
}, "navigation should throw");
SimpleTest.doesThrow(() => {
location.href = url;
}, "navigation should throw");
}
await testFetch();
SimpleTest.finish();
};
SimpleTest.waitForExplicitFinish();
</script>
</body>
</html>