Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-20 09:58:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 123383 - Make links in the Element Properties dialog inactive if they

Browse Source 
point to a URL with an unknown or unsafe protocol. r=jrgm, sr=jst, a=asa.
This commit is contained in:
mstoltz%netscape.com 2002-04-01 05:33:07 +00:00
parent 223b5637b0
commit e7a7f83a4a
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
xpfe/browser/resources/content/metadata.js
View File

@ -335,12 +335,28 @@ function hideNode(id)
document.getElementById(id).setAttribute("style", "display:none;" + style);
}
const nsIScriptSecurityManager = Components.interfaces.nsIScriptSecurityManager;
// opens the link contained in the node's "value" attribute.
function openLink(node)
{
var url = node.getAttribute("value");
nodeView._content.document.location = url;
window.close();
// Security-Critical: Only links to 'safe' protocols should be functional.
// Specifically, javascript: and data: URLs must be made non-functional
// here, because they will run with full privilege.
var safeurls = /(^http(s)?:|^file:|^chrome:|^resource:|^mailbox:|^imap:|^news:|^about:|^mailto:|^ftp:|^gopher:)/i;
if (url.search(safeurls) == 0) {
var secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"].getService().
QueryInterface(nsIScriptSecurityManager);
try {
secMan.checkLoadURIStr(nodeView._content.document.location,
url, nsIScriptSecurityManager.STANDARD);
} catch (e) {
return;
}
nodeView._content.document.location = url;
window.close();
}
}
/*