Commit 5ee57753 authored by Alex Catarineu's avatar Alex Catarineu Committed by Matthew Finkel
Browse files

Bug 467035 - Avoid leaking browser language via DTD r=Gijs,bzbarsky 

Differential Revision: https://phabricator.services.mozilla.com/D34187

--HG--
extra : moz-landing-system : lando
parent 9d059b2f

browser/base/content/test/static/browser_misused_characters_in_strings.js

+1 −0
Original line number Diff line number Diff line
@@ -272,6 +272,7 @@ add_task(async function checkAllTheFluents() { 
    {}

  );

  let domParser = new DOMParser();

  domParser.forceEnableDTD();

  for (let uri of uris) {

    let rawContents = await fetchFile(uri.spec);

    let resource = FluentResource.fromString(rawContents);

browser/components/payments/test/mochitest/formautofill/mochitest.ini

+1 −0
Original line number Diff line number Diff line
@@ -6,4 +6,5 @@ support-files = 
   ../../../../../../browser/extensions/formautofill/content/editCreditCard.xhtml

   ../../../../../../browser/extensions/formautofill/content/editAddress.xhtml



skip-if = true # Bug 1446164

[test_editCreditCard.html]

dom/base/DOMParser.cpp

+10 −1
Original line number Diff line number Diff line
@@ -33,7 +33,8 @@ DOMParser::DOMParser(nsIGlobalObject* aOwner, nsIPrincipal* aDocPrincipal, 
      mPrincipal(aDocPrincipal),

      mDocumentURI(aDocumentURI),

      mBaseURI(aBaseURI),

      mForceEnableXULXBL(false) {

      mForceEnableXULXBL(false),

      mForceEnableDTD(false) {

  MOZ_ASSERT(aDocPrincipal);

  MOZ_ASSERT(aDocumentURI);

}
@@ -69,6 +70,10 @@ already_AddRefed<Document> DOMParser::ParseFromString(const nsAString& aStr, 
      document->ForceEnableXULXBL();

    }



    if (mForceEnableDTD) {

      document->ForceSkipDTDSecurityChecks();

    }



    nsresult rv = nsContentUtils::ParseDocumentHTML(aStr, document, false);

    if (NS_WARN_IF(NS_FAILED(rv))) {

      aRv.Throw(rv);
@@ -183,6 +188,10 @@ already_AddRefed<Document> DOMParser::ParseFromStream(nsIInputStream* aStream, 
    document->ForceEnableXULXBL();

  }



  if (mForceEnableDTD) {

    document->ForceSkipDTDSecurityChecks();

  }



  // Have to pass false for reset here, else the reset will remove

  // our event listener.  Should that listener addition move to later

  // than this call?

dom/base/DOMParser.h

+7 −1
Original line number Diff line number Diff line
@@ -53,7 +53,12 @@ class DOMParser final : public nsISupports, public nsWrapperCache { 
                                             SupportedType aType,

                                             ErrorResult& aRv);



  void ForceEnableXULXBL() { mForceEnableXULXBL = true; }

  void ForceEnableXULXBL() {

    mForceEnableXULXBL = true;

    ForceEnableDTD();

  }



  void ForceEnableDTD() { mForceEnableDTD = true; }



  nsIGlobalObject* GetParentObject() const { return mOwner; }
@@ -78,6 +83,7 @@ class DOMParser final : public nsISupports, public nsWrapperCache { 
  nsCOMPtr<nsIURI> mBaseURI;



  bool mForceEnableXULXBL;

  bool mForceEnableDTD;

};



}  // namespace dom

dom/base/Document.cpp

+4 −35
Original line number Diff line number Diff line
@@ -1270,6 +1270,7 @@ Document::Document(const char* aContentType) 
      mType(eUnknown),

      mDefaultElementType(0),

      mAllowXULXBL(eTriUnset),

      mSkipDTDSecurityChecks(false),

      mBidiOptions(IBMBIDI_DEFAULT_BIDI_OPTIONS),

      mSandboxFlags(0),

      mPartID(0),
@@ -1994,38 +1995,6 @@ void Document::Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup) { 
  mChannel = aChannel;

}



/**

 * Determine whether the principal is allowed access to the localization system.

 * We don't want the web to ever see this but all our UI including in content

 * pages should pass this test.

 */

bool PrincipalAllowsL10n(nsIPrincipal* principal) {

  // The system principal is always allowed.

  if (nsContentUtils::IsSystemPrincipal(principal)) {

    return true;

  }



  nsCOMPtr<nsIURI> uri;

  nsresult rv = principal->GetURI(getter_AddRefs(uri));

  NS_ENSURE_SUCCESS(rv, false);



  bool hasFlags;



  // Allow access to uris that cannot be loaded by web content.

  rv = NS_URIChainHasFlags(uri, nsIProtocolHandler::URI_DANGEROUS_TO_LOAD,

                           &hasFlags);

  NS_ENSURE_SUCCESS(rv, false);

  if (hasFlags) {

    return true;

  }



  // UI resources also get access.

  rv = NS_URIChainHasFlags(uri, nsIProtocolHandler::URI_IS_UI_RESOURCE,

                           &hasFlags);

  NS_ENSURE_SUCCESS(rv, false);

  return hasFlags;

}



void Document::DisconnectNodeTree() {

  // Delete references to sub-documents and kill the subdocument map,

  // if any. This is not strictly needed, but makes the node tree
@@ -3263,11 +3232,11 @@ DocumentL10n* Document::GetL10n() { return mDocumentL10n; } 
bool Document::DocumentSupportsL10n(JSContext* aCx, JSObject* aObject) {

  nsCOMPtr<nsIPrincipal> callerPrincipal =

      nsContentUtils::SubjectPrincipal(aCx);

  return PrincipalAllowsL10n(callerPrincipal);

  return nsContentUtils::PrincipalAllowsL10n(callerPrincipal);

}



void Document::LocalizationLinkAdded(Element* aLinkElement) {

  if (!PrincipalAllowsL10n(NodePrincipal())) {

  if (!nsContentUtils::PrincipalAllowsL10n(NodePrincipal())) {

    return;

  }
@@ -3298,7 +3267,7 @@ void Document::LocalizationLinkAdded(Element* aLinkElement) { 
}



void Document::LocalizationLinkRemoved(Element* aLinkElement) {

  if (!PrincipalAllowsL10n(NodePrincipal())) {

  if (!nsContentUtils::PrincipalAllowsL10n(NodePrincipal())) {

    return;

  }