Bug 1263628 - meta-refresh can use a relative URL, ensure base URI is included r=gijs draft
authorAndrzej Hunt <ahunt@mozilla.com>
Fri, 15 Apr 2016 13:53:19 -0700
changeset 352168 95c9c060c1b96be7e9d95eab22b9b8ffebdbbc69
parent 352098 52e570214af308e604b413645136f340ad412711
child 352169 ac96a0a5e09c2cc60644a23cdbe8e72e94c1fcc9
push id15636
push userahunt@mozilla.com
push dateFri, 15 Apr 2016 20:54:00 +0000
reviewersgijs
bugs1263628
milestone48.0a1
Bug 1263628 - meta-refresh can use a relative URL, ensure base URI is included r=gijs E.g. articles on facebook.com provide a meta-refresh containing "0; URL=/foo/bar?....", and we previously attempted to use just this URL component, instead of constructing it using the current page URL. MozReview-Commit-ID: 4vSoz5lc1e
toolkit/components/reader/ReaderMode.jsm
--- a/toolkit/components/reader/ReaderMode.jsm
+++ b/toolkit/components/reader/ReaderMode.jsm
@@ -204,33 +204,37 @@ this.ReaderMode = {
 
         // Manually follow a meta refresh tag if one exists.
         let meta = doc.querySelector("meta[http-equiv=refresh]");
         if (meta) {
           let content = meta.getAttribute("content");
           if (content) {
             let urlIndex = content.toUpperCase().indexOf("URL=");
             if (urlIndex > -1) {
-              let url = content.substring(urlIndex + 4);
+              let baseURI = Services.io.newURI(url, null, null);
+              let newURI = Services.io.newURI(content.substring(urlIndex + 4), null, baseURI);
+              let newURL = newURI.spec;
               let ssm = Services.scriptSecurityManager;
               let flags = ssm.LOAD_IS_AUTOMATIC_DOCUMENT_REPLACEMENT |
                           ssm.DISALLOW_INHERIT_PRINCIPAL;
               try {
-                ssm.checkLoadURIStrWithPrincipal(doc.nodePrincipal, url, flags);
+                ssm.checkLoadURIStrWithPrincipal(doc.nodePrincipal, newURL, flags);
               } catch (ex) {
                 let errorMsg = "Reader mode disallowed meta refresh (reason: " + ex + ").";
 
                 if (Services.prefs.getBoolPref("reader.errors.includeURLs"))
-                  errorMsg += " Refresh target URI: '" + url + "'.";
+                  errorMsg += " Refresh target URI: '" + newURL + "'.";
                 reject(errorMsg);
                 return;
               }
               // Otherwise, pass an object indicating our new URL:
-              reject({newURL: url});
-              return;
+              if (!baseURI.equalsExceptRef(newURI)) {
+                reject({newURL});
+                return;
+              }
             }
           }
         }
         let responseURL = xhr.responseURL;
         let givenURL = url;
         // Convert these to real URIs to make sure the escaping (or lack
         // thereof) is identical:
         try {