Bug 619092 - Truncate wyciwyg URLs on Reload to prevent exposing them; r=bz draft
authorYaroslav Taben <yaroslav.taben@mail.utoronto.ca>
Fri, 16 Feb 2018 16:55:35 -0500
changeset 756317 d69d7619a6a83c2c62aa2c2f6f61122962949c3a
parent 756304 9f7748da84af39b37901b18d0b986d7d75108722
push id99476
push userbmo:yaroslav.taben@mail.utoronto.ca
push dateFri, 16 Feb 2018 22:00:44 +0000
reviewersbz
bugs619092
milestone60.0a1
Bug 619092 - Truncate wyciwyg URLs on Reload to prevent exposing them; r=bz This change prevents URLs with wyciwyg schemes to be set as mDocumentURI. Otherwise, in JS, document.URL returns a wyciwyg://* URL and a subsequent call to document.write makes wycywyg URL visible in the address bar. MozReview-Commit-ID: BaKpDkkIYbM
dom/base/nsDocument.cpp
dom/html/test/browser_refresh_wyciwyg_url.js
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -2239,16 +2239,26 @@ nsDocument::Reset(nsIChannel* aChannel, 
   nsCOMPtr<nsIURI> uri;
   nsCOMPtr<nsIPrincipal> principal;
   if (aChannel) {
     // Note: this code is duplicated in XULDocument::StartDocumentLoad and
     // nsScriptSecurityManager::GetChannelResultPrincipal.
     // Note: this should match nsDocShell::OnLoadingSite
     NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
 
+  bool isWyciwyg = false;
+  uri->SchemeIs("wyciwyg", &isWyciwyg);
+  if (isWyciwyg) {
+    nsCOMPtr<nsIURI> cleanURI;
+    nsresult rv = nsContentUtils::RemoveWyciwygScheme(uri, getter_AddRefs(cleanURI));
+    if (NS_SUCCEEDED(rv)) {
+      uri = cleanURI;
+    }
+  }
+
     nsIScriptSecurityManager *securityManager =
       nsContentUtils::GetSecurityManager();
     if (securityManager) {
       securityManager->GetChannelResultPrincipal(aChannel,
                                                  getter_AddRefs(principal));
     }
   }
 
--- a/dom/html/test/browser_refresh_wyciwyg_url.js
+++ b/dom/html/test/browser_refresh_wyciwyg_url.js
@@ -20,13 +20,13 @@ function test(){
         is(aBrowser.contentDocument.URL, testURL, "Make sure we start at the correct URL");
 
         // test_btn calls document.write() then reloads the document
         test_btn = aBrowser.contentDocument.getElementById("test_btn");
         test_btn.click();
         return BrowserTestUtils.browserLoaded(aBrowser);
     }).then(() => {
         test_btn.click();
-        todo_is(aBrowser.contentDocument.URL, testURL, "Document URL should be identical after reload");
+        is(aBrowser.contentDocument.URL, testURL, "Document URL should be identical after reload");
         gBrowser.removeTab(aTab);
         finish();
     });
 }