Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-06 17:16:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix for bug 161546. r=alecf, sr=heikki. JS and data urls can no longer be loaded from the history window or sidebar. An alert with an error will pop up if a user tries to load such urls from the history window/sidebar. a=asa.

Browse Source
This commit is contained in:
nisheeth%netscape.com 2006-07-27 14:57:06 +00:00
parent cff0944246
commit e1d514f68a
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
suite/common/history/history.js
View File

@ -278,7 +278,22 @@ function OpenURL(aInNewWindow)
var currentIndex = gHistoryTree.currentIndex;
var builder = gHistoryTree.builder.QueryInterface(Components.interfaces.nsIXULTreeBuilder);
var url = builder.getResourceAtIndex(currentIndex).Value;
var uri = Components.classes["@mozilla.org/network/standard-url;1"].
createInstance(Components.interfaces.nsIURI);
uri.spec = url;
if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
var strBundleService = Components.classes["@mozilla.org/intl/stringbundle;1"]
.getService(Components.interfaces.nsIStringBundleService);
var promptService = Components.classes["@mozilla.org/embedcomp/prompt-service;1"]
.getService(Components.interfaces.nsIPromptService);
var historyBundle = strBundleService.createBundle("chrome://communicator/locale/history/history.properties");
var brandBundle = strBundleService.createBundle("chrome://global/locale/brand.properties");
var brandStr = brandBundle.GetStringFromName("brandShortName");
var errorStr = historyBundle.GetStringFromName("load-js-data-url-error");
promptService.alert(window, brandStr, errorStr);
return false;
}
if (aInNewWindow) {
var count = gHistoryTree.treeBoxObject.view.selection.count;
if (count == 1) {

2
suite/locales/en-US/chrome/common/history/history.properties
View File

@ -17,3 +17,5 @@ collapseLabel=Collapse
expandLabel=Expand
collapseAccesskey=C
expandAccesskey=x
load-js-data-url-error=For security reasons, javascript or data urls cannot be loaded from the history window or sidebar.