Commit 0ecd4da5 authored by ma1's avatar ma1 Committed by Pier Angelo Vendrame
Browse files

TB 8324: Prevent DNS proxy bypasses caused by Drag&Drop 

Bug 41613: Skip Drang & Drop filtering for DNS-safe URLs
parent fc6d504b

browser/app/profile/000-tor-browser.js

+1 −0
Original line number Original line Diff line number Diff line
@@ -139,3 +139,4 @@ pref("browser.torMoat.loglevel", "Warn"); 
pref("browser.tordomainisolator.loglevel", "Warn");

pref("browser.tordomainisolator.loglevel", "Warn");

pref("browser.torcircuitpanel.loglevel", "Log");

pref("browser.torcircuitpanel.loglevel", "Log");

pref("browser.tor_android.log_level", "Info");

pref("browser.tor_android.log_level", "Info");

pref("browser.dragdropfilter.log_level", "Warn");

browser/components/BrowserComponents.manifest

+1 −0
Original line number Original line Diff line number Diff line
@@ -52,6 +52,7 @@ category browser-first-window-ready resource://gre/modules/SandboxUtils.sys.mjs 
#endif

#endif

category browser-first-window-ready moz-src:///browser/modules/ClipboardPrivacy.sys.mjs ClipboardPrivacy.init

category browser-first-window-ready moz-src:///browser/modules/ClipboardPrivacy.sys.mjs ClipboardPrivacy.init

category browser-first-window-ready moz-src:///browser/modules/SecurityLevelNotification.sys.mjs SecurityLevelNotification.ready

category browser-first-window-ready moz-src:///browser/modules/SecurityLevelNotification.sys.mjs SecurityLevelNotification.ready

category browser-first-window-ready moz-src:///toolkit/modules/DragDropFilter.sys.mjs DragDropFilter.init





category browser-idle-startup resource:///modules/PlacesUIUtils.sys.mjs PlacesUIUtils.unblockToolbars

category browser-idle-startup resource:///modules/PlacesUIUtils.sys.mjs PlacesUIUtils.unblockToolbars

category browser-idle-startup resource:///modules/BuiltInThemes.sys.mjs BuiltInThemes.ensureBuiltInThemes

category browser-idle-startup resource:///modules/BuiltInThemes.sys.mjs BuiltInThemes.ensureBuiltInThemes

browser/components/places/PlacesUIUtils.sys.mjs

+5 −1
Original line number Original line Diff line number Diff line
@@ -1802,7 +1802,11 @@ ChromeUtils.defineLazyGetter(PlacesUIUtils, "URI_FLAVORS", () => { 
  ];

  ];

});

});

ChromeUtils.defineLazyGetter(PlacesUIUtils, "SUPPORTED_FLAVORS", () => {

ChromeUtils.defineLazyGetter(PlacesUIUtils, "SUPPORTED_FLAVORS", () => {

  return [...PlacesUIUtils.PLACES_FLAVORS, ...PlacesUIUtils.URI_FLAVORS];

  return [

    ...PlacesUIUtils.PLACES_FLAVORS,

    ...PlacesUIUtils.URI_FLAVORS,

    "application/x-torbrowser-opaque",

  ];

});

});





ChromeUtils.defineLazyGetter(PlacesUIUtils, "ellipsis", function () {

ChromeUtils.defineLazyGetter(PlacesUIUtils, "ellipsis", function () {

browser/components/places/content/controller.js

+1 −0
Original line number Original line Diff line number Diff line
@@ -1277,6 +1277,7 @@ PlacesController.prototype = { 
    [

    [

      PlacesUtils.TYPE_X_MOZ_PLACE,

      PlacesUtils.TYPE_X_MOZ_PLACE,

      PlacesUtils.TYPE_X_MOZ_URL,

      PlacesUtils.TYPE_X_MOZ_URL,

      "application/x-torbrowser-opaque",

      PlacesUtils.TYPE_PLAINTEXT,

      PlacesUtils.TYPE_PLAINTEXT,

    ].forEach(type => xferable.addDataFlavor(type));

    ].forEach(type => xferable.addDataFlavor(type));

dom/base/ContentAreaDropListener.sys.mjs

+14 −2
Original line number Original line Diff line number Diff line
@@ -2,6 +2,12 @@ 
 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */





const lazy = {};



ChromeUtils.defineESModuleGetters(lazy, {

  OpaqueDrag: "moz-src:///toolkit/modules/DragDropFilter.sys.mjs",

});



// This component is used for handling dragover and drop of urls.

// This component is used for handling dragover and drop of urls.

//

//

// It checks to see whether a drop of a url is allowed. For instance, a url

// It checks to see whether a drop of a url is allowed. For instance, a url
@@ -40,10 +46,15 @@ ContentAreaDropListener.prototype = { 
      }

      }

    }

    }





    type = "text/x-moz-url";

    for (let type of ["text/x-moz-url", "application/x-torbrowser-opaque"]) {

    if (types.contains(type)) {

      if (!types.contains(type)) {

        continue;

      }

      data = dt.mozGetDataAt(type, i);

      data = dt.mozGetDataAt(type, i);

      if (data) {

      if (data) {

        if (type === "application/x-torbrowser-opaque") {

          ({ type, value: data = "" } = lazy.OpaqueDrag.retrieve(data));

        }

        let lines = data.split("\n");

        let lines = data.split("\n");

        for (let i = 0, length = lines.length; i < length; i += 2) {

        for (let i = 0, length = lines.length; i < length; i += 2) {

          this._addLink(links, lines[i], lines[i + 1], type);

          this._addLink(links, lines[i], lines[i + 1], type);
@@ -236,6 +247,7 @@ ContentAreaDropListener.prototype = { 
    if (

    if (

      !types.includes("application/x-moz-file") &&

      !types.includes("application/x-moz-file") &&

      !types.includes("text/x-moz-url") &&

      !types.includes("text/x-moz-url") &&

      !types.includes("application/x-torbrowser-opaque") &&

      !types.includes("text/uri-list") &&

      !types.includes("text/uri-list") &&

      !types.includes("text/x-moz-text-internal") &&

      !types.includes("text/x-moz-text-internal") &&

      !types.includes("text/plain")

      !types.includes("text/plain")