mirror of
https://github.com/roytam1/UXP.git
synced 2026-05-26 13:58:49 +00:00
moebius#226: Consider blocking top level window data: URIs (part 2/2 without tests)
https://github.com/MoonchildProductions/moebius/pull/226
This commit is contained in:
@@ -9885,15 +9885,6 @@ nsDocShell::InternalLoad(nsIURI* aURI,
|
||||
contentType = nsIContentPolicy::TYPE_DOCUMENT;
|
||||
}
|
||||
|
||||
if (!nsContentSecurityManager::AllowTopLevelNavigationToDataURI(
|
||||
aURI,
|
||||
contentType,
|
||||
aTriggeringPrincipal,
|
||||
(aLoadType == LOAD_NORMAL_EXTERNAL))) {
|
||||
// logging to console happens within AllowTopLevelNavigationToDataURI
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
// If there's no targetDocShell, that means we are about to create a new window,
|
||||
// perform a content policy check before creating the window.
|
||||
if (!targetDocShell) {
|
||||
@@ -10962,6 +10953,7 @@ nsDocShell::DoURILoad(nsIURI* aURI,
|
||||
if (aPrincipalToInherit) {
|
||||
loadInfo->SetPrincipalToInherit(aPrincipalToInherit);
|
||||
}
|
||||
loadInfo->SetLoadTriggeredFromExternal(aLoadFromExternal);
|
||||
|
||||
// We have to do this in case our OriginAttributes are different from the
|
||||
// OriginAttributes of the parent document. Or in case there isn't a
|
||||
|
||||
Reference in New Issue
Block a user