Verified Commit 7d9abcbb authored by Tom Schuster's avatar Tom Schuster Committed by ma1
Browse files

Bug 672618 - Don't execute javascript: URLs on CTRL+click, middle-click etc. r=dao 

Differential Revision: https://phabricator.services.mozilla.com/D256648

BB 44100: cherry-picked except tests
parent 33bea4df

browser/actors/ClickHandlerChild.sys.mjs

+23 −8
Original line number Diff line number Diff line
@@ -12,12 +12,26 @@ ChromeUtils.defineESModuleGetters(lazy, { 
  E10SUtils: "resource://gre/modules/E10SUtils.sys.mjs",

});



XPCOMUtils.defineLazyPreferenceGetter(

  lazy,

  "autoscrollEnabled",

  "general.autoScroll",

  true

);



XPCOMUtils.defineLazyPreferenceGetter(

  lazy,

  "blockJavascript",

  "browser.link.alternative_click.block_javascript",

  true

);



export class MiddleMousePasteHandlerChild extends JSWindowActorChild {

  handleEvent(clickEvent) {

    if (

      clickEvent.defaultPrevented ||

      clickEvent.button != 1 ||

      MiddleMousePasteHandlerChild.autoscrollEnabled

      lazy.autoscrollEnabled

    ) {

      return;

    }
@@ -34,13 +48,6 @@ export class MiddleMousePasteHandlerChild extends JSWindowActorChild { 
  }

}



XPCOMUtils.defineLazyPreferenceGetter(

  MiddleMousePasteHandlerChild,

  "autoscrollEnabled",

  "general.autoScroll",

  true

);



export class ClickHandlerChild extends JSWindowActorChild {

  handleEvent(wrapperEvent) {

    this.handleClickEvent(wrapperEvent.sourceEvent);
@@ -112,6 +119,14 @@ export class ClickHandlerChild extends JSWindowActorChild { 
    };



    if (href && !isFromMiddleMousePasteHandler) {

      if (

        lazy.blockJavascript &&

        Services.io.extractScheme(href) == "javascript"

      ) {

        // We don't want to open new tabs or windows for javascript: links.

        return;

      }



      try {

        Services.scriptSecurityManager.checkLoadURIStrWithPrincipal(

          principal,

browser/app/profile/firefox.js

+3 −0
Original line number Diff line number Diff line
@@ -880,6 +880,9 @@ pref("browser.link.open_newwindow.restriction", 2); 
  pref("browser.link.open_newwindow.disabled_in_fullscreen", false);

#endif



// If true, opening javscript: URLs using middle-click, CTRL+click etc. are blocked.

pref("browser.link.alternative_click.block_javascript", true);



// Tabbed browser

pref("browser.tabs.closeTabByDblclick", false);

pref("browser.tabs.closeWindowWithLastTab", true);