Commit 035c84a1 authored by Marcos Cáceres's avatar Marcos Cáceres
Browse files

Bug 1661174 - restrict schemes supported by Web Share API r=edgar,ckerschb 

Restrict to "loadable" URLs. Also exclude blob URLs.

Differential Revision: https://phabricator.services.mozilla.com/D88371
parent 7d913473

dom/base/Navigator.cpp

+14 −0
Original line number Diff line number Diff line
@@ -1417,6 +1417,20 @@ Promise* Navigator::Share(const ShareData& aData, ErrorResult& aRv) { 
      return nullptr;

    }

    url = result.unwrap();

    // Check that we only share loadable URLs (e.g., http/https).

    // we also exclude blobs, as it doesn't make sense to share those outside

    // the context of the browser.

    const uint32_t flags =

        nsIScriptSecurityManager::DISALLOW_INHERIT_PRINCIPAL |

        nsIScriptSecurityManager::DISALLOW_SCRIPT;

    if (NS_FAILED(

            nsContentUtils::GetSecurityManager()->CheckLoadURIWithPrincipal(

                doc->NodePrincipal(), url, flags, doc->InnerWindowID())) ||

        url->SchemeIs("blob")) {

      aRv.ThrowTypeError<MSG_INVALID_URL_SCHEME>("Share",

                                                 url->GetSpecOrDefault());

      return nullptr;

    }

  }



  // Process the title member...

testing/web-platform/meta/web-share/share-url-invalid.https.html.ini

+17 −9
Original line number Diff line number Diff line
@@ -4,21 +4,29 @@ 
      if os == "win": FAIL



  [share() rejects file:// URLs]

    expected: FAIL

    expected:

      if os == "win": FAIL



  [share() rejects data: URLs]

    expected: FAIL

  [share() rejects about: URLs]

    expected:

      if os == "win": FAIL



  [share() rejects chrome: URLs]

    expected:

      if os == "win": FAIL



  [share() rejects wss: URLs]

    expected: FAIL

  [share() rejects blob: URLs]

    expected:

      if os == "win": FAIL



  [share() rejects about: URLs]

    expected: FAIL

  [share() rejects wss: URLs]

    expected:

      if os == "win": FAIL



  [share() rejects blob: URLs]

    expected: FAIL

  [share() rejects data: URLs]

    expected:

      if os == "win": FAIL



  [share() rejects javascript: URLs]

    expected:

      if os == "win": FAIL

testing/web-platform/tests/web-share/share-url-invalid.https.html

+6 −0
Original line number Diff line number Diff line
@@ -40,6 +40,12 @@ 
        return promise_rejects_js(t, TypeError, promise);

      }, "share() rejects chrome: URLs");



      promise_test(async t => {

        await test_driver.bless();

        const promise = navigator.share({ url: "javascript:window.alert('error')" });

        return promise_rejects_js(t, TypeError, promise);

      }, "share() rejects javascript: URLs");



      promise_test(async t => {

        await test_driver.bless();

        const file = new File([], "text/plain");