mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-12-04 11:26:09 +00:00
8ec2442bf5
Loads targeting cross-process BrowsingContexts are by definition cross-origin, which should preclude any javascript: loads. While those loads are currently prevented by principal checks in the final target process, sending IPC messages for the attempts is unnecessary, and potentially opens a door to privilege escalation exploits by a compromised content process. This patch prevents any cross-process load requests from being sent by content processes, and adds checks in the parent process to kill any (potentially compromised) content process which attempts to send them. Differential Revision: https://phabricator.services.mozilla.com/D103529
43 lines
915 B
HTML
43 lines
915 B
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<script type="application/javascript">
|
|
"use strict";
|
|
|
|
window.onload = () => {
|
|
opener.postMessage("ready", "*");
|
|
};
|
|
|
|
// eslint-disable-next-line no-shadow
|
|
function promiseMessage(source, filter = event => true) {
|
|
return new Promise(resolve => {
|
|
function listener(event) {
|
|
if (event.source == source && filter(event)) {
|
|
removeEventListener("message", listener);
|
|
resolve(event);
|
|
}
|
|
}
|
|
addEventListener("message", listener);
|
|
});
|
|
}
|
|
|
|
// Sends a message to the given target window and waits for the response.
|
|
function ping(target) {
|
|
let msg = { ping: Math.random() };
|
|
target.postMessage(msg, "*");
|
|
return promiseMessage(
|
|
target,
|
|
event => event.data && event.data.pong == msg.ping
|
|
);
|
|
}
|
|
|
|
function setFrameLocation(name, uri) {
|
|
window[name].location = uri;
|
|
}
|
|
</script>
|
|
</head>
|
|
<body>
|
|
</body>
|
|
</html>
|