Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup, r?baku draft
authorGijs Kruitbosch <gijskruitbosch@gmail.com>
Sun, 02 Oct 2016 22:54:20 +0100
changeset 419935 e22f1b6d649be57fe3c460c2531fbe20bf7210f4
parent 419507 5ffed033557e5b6f9694123f1948f867f913ede3
child 532681 c26e8b8a95041c54ad19301c894e74c1b845a597
push id31046
push usergijskruitbosch@gmail.com
push dateSun, 02 Oct 2016 21:56:29 +0000
reviewersbaku
bugs1295002
milestone52.0a1
Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup, r?baku This seems like much the simplest way to prevent the recursion. Other alternatives include some kind of member var to track state (which wouldn't be threadsafe, though I don't know that that really matters for this component) or adding a field on nsIDefaultURIFixupInfo, which seems ugly. This is a bit hacky, but it seems to work. MozReview-Commit-ID: 7CCVvENSRVD
docshell/base/nsDefaultURIFixup.cpp
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@@ -188,21 +188,30 @@ nsDefaultURIFixup::GetFixupURIInfo(const
 
   if (scheme.LowerCaseEqualsLiteral("view-source")) {
     nsCOMPtr<nsIURIFixupInfo> uriInfo;
     // We disable keyword lookup and alternate URIs so that small typos don't
     // cause us to look at very different domains
     uint32_t newFixupFlags = aFixupFlags & ~FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP
                                          & ~FIXUP_FLAGS_MAKE_ALTERNATE_URI;
 
-    rv = GetFixupURIInfo(Substring(uriString,
-                                   sizeof("view-source:") - 1,
-                                   uriString.Length() -
-                                   (sizeof("view-source:") - 1)),
-                         newFixupFlags, aPostData, getter_AddRefs(uriInfo));
+    const uint32_t viewSourceLen = sizeof("view-source:") - 1;
+    nsAutoCString innerURIString(Substring(uriString, viewSourceLen,
+                                           uriString.Length() -
+                                           viewSourceLen));
+    // Prevent recursion:
+    innerURIString.Trim(" ");
+    nsAutoCString innerScheme;
+    ioService->ExtractScheme(innerURIString, innerScheme);
+    if (innerScheme.LowerCaseEqualsLiteral("view-source")) {
+      return NS_ERROR_FAILURE;
+    }
+
+    rv = GetFixupURIInfo(innerURIString, newFixupFlags, aPostData,
+                         getter_AddRefs(uriInfo));
     if (NS_FAILED(rv)) {
       return NS_ERROR_FAILURE;
     }
     nsAutoCString spec;
     nsCOMPtr<nsIURI> uri;
     uriInfo->GetPreferredURI(getter_AddRefs(uri));
     if (!uri) {
       return NS_ERROR_FAILURE;