Skip to content
Snippets Groups Projects
Verified Commit 8b57c078 authored by ma1's avatar ma1
Browse files

fixup! Bug 42835: Create an actor to filter file data transfers

Bug 43064: Make file filtering more specific
parent 2f7553e2
No related branches found
Tags tor-browser-128.1.0esr-14.0-1-build4
1 merge request!1111Bug 43064: Make file filtering more specific
Pipeline #196047 passed
......@@ -12,11 +12,14 @@ ChromeUtils.defineLazyGetter(lazy, "console", () => {
export class FilesFilterChild extends JSWindowActorChild {
handleEvent(event) {
if (!Services.prefs.getBoolPref("browser.filesfilter.enabled", true)) {
return;
}
// drop or paste
const { composedTarget } = event;
const dt = event.clipboardData || event.dataTransfer;
if (dt.files.length) {
if ([...dt.files].some(f => f.mozFullPath)) {
if (
["HTMLInputElement", "HTMLTextAreaElement"].includes(
ChromeUtils.getClassName(composedTarget)
......@@ -25,7 +28,7 @@ export class FilesFilterChild extends JSWindowActorChild {
event.preventDefault();
lazy.console.log(
`Preventing path leak on ${event.type} for ${[...dt.files]
.map(f => f.name)
.map(f => `${f.name} (${f.mozFullPath})`)
.join(", ")}.`
);
}
......@@ -33,7 +36,7 @@ export class FilesFilterChild extends JSWindowActorChild {
}
// "Paste Without Formatting" (ctrl+shift+V) in HTML editors coerces files into paths
if (!(event.clipboardData && dt.getData("text"))) {
if (!(event.clipboardData && /[\/\\]/.test(dt.getData("text")))) {
return;
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment