mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-29 15:52:07 +00:00
0cc257addd
Backed out changeset e44c9fd81e5b (bug 1558915) Backed out changeset 3da6e9e86be4 (bug 1558915)
102 lines
3.0 KiB
C++
102 lines
3.0 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
|
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "ServiceWorkerUtils.h"
|
|
|
|
#include "mozilla/Preferences.h"
|
|
#include "mozilla/dom/ClientInfo.h"
|
|
#include "mozilla/dom/ServiceWorkerRegistrarTypes.h"
|
|
#include "nsIURL.h"
|
|
|
|
namespace mozilla {
|
|
namespace dom {
|
|
|
|
bool ServiceWorkerParentInterceptEnabled() {
|
|
static Atomic<bool> sEnabled;
|
|
static Atomic<bool> sInitialized;
|
|
if (!sInitialized) {
|
|
AssertIsOnMainThread();
|
|
sInitialized = true;
|
|
sEnabled =
|
|
Preferences::GetBool("dom.serviceWorkers.parent_intercept", false);
|
|
}
|
|
return sEnabled;
|
|
}
|
|
|
|
bool ServiceWorkerRegistrationDataIsValid(
|
|
const ServiceWorkerRegistrationData& aData) {
|
|
return !aData.scope().IsEmpty() && !aData.currentWorkerURL().IsEmpty() &&
|
|
!aData.cacheName().IsEmpty();
|
|
}
|
|
|
|
namespace {
|
|
|
|
nsresult CheckForSlashEscapedCharsInPath(nsIURI* aURI) {
|
|
MOZ_ASSERT(aURI);
|
|
|
|
// A URL that can't be downcast to a standard URL is an invalid URL and should
|
|
// be treated as such and fail with SecurityError.
|
|
nsCOMPtr<nsIURL> url(do_QueryInterface(aURI));
|
|
if (NS_WARN_IF(!url)) {
|
|
return NS_ERROR_DOM_SECURITY_ERR;
|
|
}
|
|
|
|
nsAutoCString path;
|
|
nsresult rv = url->GetFilePath(path);
|
|
if (NS_WARN_IF(NS_FAILED(rv))) {
|
|
return rv;
|
|
}
|
|
|
|
ToLowerCase(path);
|
|
if (path.Find("%2f") != kNotFound || path.Find("%5c") != kNotFound) {
|
|
return NS_ERROR_DOM_TYPE_ERR;
|
|
}
|
|
|
|
return NS_OK;
|
|
}
|
|
|
|
} // anonymous namespace
|
|
|
|
nsresult ServiceWorkerScopeAndScriptAreValid(const ClientInfo& aClientInfo,
|
|
nsIURI* aScopeURI,
|
|
nsIURI* aScriptURI) {
|
|
MOZ_DIAGNOSTIC_ASSERT(aScopeURI);
|
|
MOZ_DIAGNOSTIC_ASSERT(aScriptURI);
|
|
|
|
nsCOMPtr<nsIPrincipal> principal = aClientInfo.GetPrincipal();
|
|
NS_ENSURE_TRUE(principal, NS_ERROR_DOM_INVALID_STATE_ERR);
|
|
|
|
bool isHttp = aScriptURI->SchemeIs("http");
|
|
bool isHttps = aScriptURI->SchemeIs("https");
|
|
NS_ENSURE_TRUE(isHttp || isHttps, NS_ERROR_DOM_SECURITY_ERR);
|
|
|
|
nsresult rv = CheckForSlashEscapedCharsInPath(aScopeURI);
|
|
NS_ENSURE_SUCCESS(rv, rv);
|
|
|
|
rv = CheckForSlashEscapedCharsInPath(aScriptURI);
|
|
NS_ENSURE_SUCCESS(rv, rv);
|
|
|
|
nsAutoCString ref;
|
|
Unused << aScopeURI->GetRef(ref);
|
|
NS_ENSURE_TRUE(ref.IsEmpty(), NS_ERROR_DOM_SECURITY_ERR);
|
|
|
|
Unused << aScriptURI->GetRef(ref);
|
|
NS_ENSURE_TRUE(ref.IsEmpty(), NS_ERROR_DOM_SECURITY_ERR);
|
|
|
|
rv = principal->CheckMayLoad(aScopeURI, true /* report */,
|
|
false /* allowIfInheritsPrincipal */);
|
|
NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_SECURITY_ERR);
|
|
|
|
rv = principal->CheckMayLoad(aScriptURI, true /* report */,
|
|
false /* allowIfInheritsPrincipal */);
|
|
NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_SECURITY_ERR);
|
|
|
|
return NS_OK;
|
|
}
|
|
|
|
} // namespace dom
|
|
} // namespace mozilla
|