Commit 5cc2b047 authored by Alex Catarineu's avatar Alex Catarineu Committed by Matthew Finkel
Browse files

Bug 1581537 - Avoid several browser language leaks r=smaug 

Spoof dom/dom.properties, layout/xmlparser.properties,
layout/MediaDocument.properties to en-US if needed.

Differential Revision: https://phabricator.services.mozilla.com/D46034

--HG--
extra : moz-landing-system : lando
parent 76a3de35

browser/base/content/test/static/browser_misused_characters_in_strings.js

+6 −0
Original line number Diff line number Diff line
@@ -99,6 +99,12 @@ let gWhitelist = [ 
    key: "PatternAttributeCompileFailure",

    type: "single-quote",

  },

  // dom.properties is packaged twice so we need to have two exceptions for this string.

  {

    file: "dom.properties",

    key: "PatternAttributeCompileFailure",

    type: "single-quote",

  },

  {

    file: "netError.dtd",

    key: "inadequateSecurityError.longDesc",

browser/installer/package-manifest.in

+3 −0
Original line number Diff line number Diff line
@@ -345,6 +345,9 @@ 
@RESPATH@/res/dtd/*

@RESPATH@/res/language.properties

@RESPATH@/res/locale/layout/HtmlForm.properties

@RESPATH@/res/locale/layout/MediaDocument.properties

@RESPATH@/res/locale/layout/xmlparser.properties

@RESPATH@/res/locale/dom/dom.properties

#ifdef XP_MACOSX

@RESPATH@/res/MainMenu.nib/

#endif

dom/base/Document.cpp

+6 −2
Original line number Diff line number Diff line
@@ -3238,7 +3238,7 @@ bool Document::DocumentSupportsL10n(JSContext* aCx, JSObject* aObject) { 
}



void Document::LocalizationLinkAdded(Element* aLinkElement) {

  if (!nsContentUtils::PrincipalAllowsL10n(NodePrincipal(), GetDocumentURI())) {

  if (!AllowsL10n()) {

    return;

  }
@@ -3269,7 +3269,7 @@ void Document::LocalizationLinkAdded(Element* aLinkElement) { 
}



void Document::LocalizationLinkRemoved(Element* aLinkElement) {

  if (!nsContentUtils::PrincipalAllowsL10n(NodePrincipal(), GetDocumentURI())) {

  if (!AllowsL10n()) {

    return;

  }
@@ -3321,6 +3321,10 @@ void Document::InitialDocumentTranslationCompleted() { 
  mPendingInitialTranslation = false;

}



bool Document::AllowsL10n() const {

  return nsContentUtils::PrincipalAllowsL10n(NodePrincipal(), GetDocumentURI());

}



bool Document::IsWebAnimationsEnabled(JSContext* aCx, JSObject* /*unused*/) {

  MOZ_ASSERT(NS_IsMainThread());

dom/base/Document.h

+5 −0
Original line number Diff line number Diff line
@@ -3664,6 +3664,11 @@ class Document : public nsINode, 
   */

  virtual void InitialDocumentTranslationCompleted();



  /**

   * Returns whether the document allows localization.

   */

  bool AllowsL10n() const;



 protected:

  RefPtr<DocumentL10n> mDocumentL10n;

dom/base/nsContentUtils.cpp

+42 −13
Original line number Diff line number Diff line
@@ -3581,8 +3581,8 @@ static const char* gPropertiesFiles[nsContentUtils::PropertiesFile_COUNT] = { 
    "chrome://global/locale/mathml/mathml.properties",

    "chrome://global/locale/security/security.properties",

    "chrome://necko/locale/necko.properties",

    "chrome://global/locale/layout/HtmlForm.properties",

    "resource://gre/res/locale/layout/HtmlForm.properties"};

    "resource://gre/res/locale/layout/HtmlForm.properties",

    "resource://gre/res/locale/dom/dom.properties"};



/* static */

nsresult nsContentUtils::EnsureStringBundle(PropertiesFile aFile) {
@@ -3631,39 +3631,68 @@ void nsContentUtils::AsyncPrecreateStringBundles() { 
  }

}



static bool SpoofLocaleEnglish() {

/* static */

bool nsContentUtils::SpoofLocaleEnglish() {

  // 0 - will prompt

  // 1 - don't spoof

  // 2 - spoof

  return StaticPrefs::privacy_spoof_english() == 2;

}



static nsContentUtils::PropertiesFile GetMaybeSpoofedPropertiesFile(

    nsContentUtils::PropertiesFile aFile, const char* aKey,

    Document* aDocument) {

  // When we spoof English, use en-US properties in strings that are accessible

  // by content.

  bool spoofLocale = nsContentUtils::SpoofLocaleEnglish() &&

                     (!aDocument || !aDocument->AllowsL10n());

  if (spoofLocale) {

    switch (aFile) {

      case nsContentUtils::eFORMS_PROPERTIES:

        return nsContentUtils::eFORMS_PROPERTIES_en_US;

      case nsContentUtils::eDOM_PROPERTIES:

        return nsContentUtils::eDOM_PROPERTIES_en_US;

      default:

        break;

    }

  }

  return aFile;

}



/* static */

nsresult nsContentUtils::GetLocalizedString(PropertiesFile aFile,

nsresult nsContentUtils::GetMaybeLocalizedString(PropertiesFile aFile,

                                                 const char* aKey,

                                                 Document* aDocument,

                                                 nsAString& aResult) {

  // When we spoof English, use en-US default strings in HTML forms.

  if (aFile == eFORMS_PROPERTIES_MAYBESPOOF && SpoofLocaleEnglish()) {

    aFile = eFORMS_PROPERTIES_en_US;

  return GetLocalizedString(

      GetMaybeSpoofedPropertiesFile(aFile, aKey, aDocument), aKey, aResult);

}



/* static */

nsresult nsContentUtils::GetLocalizedString(PropertiesFile aFile,

                                            const char* aKey,

                                            nsAString& aResult) {

  nsresult rv = EnsureStringBundle(aFile);

  NS_ENSURE_SUCCESS(rv, rv);

  nsIStringBundle* bundle = sStringBundles[aFile];

  return bundle->GetStringFromName(aKey, aResult);

}



/* static */

nsresult nsContentUtils::FormatMaybeLocalizedString(

    PropertiesFile aFile, const char* aKey, Document* aDocument,

    const char16_t** aParams, uint32_t aParamsLength, nsAString& aResult) {

  return FormatLocalizedString(

      GetMaybeSpoofedPropertiesFile(aFile, aKey, aDocument), aKey, aParams,

      aParamsLength, aResult);

}



/* static */

nsresult nsContentUtils::FormatLocalizedString(PropertiesFile aFile,

                                               const char* aKey,

                                               const char16_t** aParams,

                                               uint32_t aParamsLength,

                                               nsAString& aResult) {

  // When we spoof English, use en-US default strings in HTML forms.

  if (aFile == eFORMS_PROPERTIES_MAYBESPOOF && SpoofLocaleEnglish()) {

    aFile = eFORMS_PROPERTIES_en_US;

  }



  nsresult rv = EnsureStringBundle(aFile);

  NS_ENSURE_SUCCESS(rv, rv);

  nsIStringBundle* bundle = sStringBundles[aFile];