Commit d8207a8f authored by ma1's avatar ma1 Committed by Pier Angelo Vendrame
Browse files

TB 8324: Prevent DNS proxy bypasses caused by Drag&Drop 

Bug 41613: Skip Drang & Drop filtering for DNS-safe URLs
parent 80ea3983

browser/app/profile/000-tor-browser.js

+1 −0
Original line number Diff line number Diff line
@@ -137,3 +137,4 @@ pref("browser.torMoat.loglevel", "Warn"); 
pref("browser.tordomainisolator.loglevel", "Warn");

pref("browser.torcircuitpanel.loglevel", "Log");

pref("browser.tor_android.log_level", "Info");

pref("browser.dragdropfilter.log_level", "Warn");

browser/components/BrowserGlue.sys.mjs

+3 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ ChromeUtils.defineESModuleGetters(lazy, { 
  DoHController: "resource:///modules/DoHController.sys.mjs",

  DownloadsViewableInternally:

    "resource:///modules/DownloadsViewableInternally.sys.mjs",

  DragDropFilter: "resource://gre/modules/DragDropFilter.sys.mjs",

  E10SUtils: "resource://gre/modules/E10SUtils.sys.mjs",

  ExtensionsUI: "resource:///modules/ExtensionsUI.sys.mjs",

  FeatureGate: "resource://featuregates/FeatureGate.sys.mjs",
@@ -2046,6 +2047,8 @@ BrowserGlue.prototype = { 
      lazy.SelectableProfileService.init().catch(console.error);

    }



    lazy.DragDropFilter.init();



    lazy.TorProviderBuilder.firstWindowLoaded();



    ClipboardPrivacy.startup();

browser/components/places/PlacesUIUtils.sys.mjs

+5 −1
Original line number Diff line number Diff line
@@ -1804,7 +1804,11 @@ ChromeUtils.defineLazyGetter(PlacesUIUtils, "URI_FLAVORS", () => { 
  ];

});

ChromeUtils.defineLazyGetter(PlacesUIUtils, "SUPPORTED_FLAVORS", () => {

  return [...PlacesUIUtils.PLACES_FLAVORS, ...PlacesUIUtils.URI_FLAVORS];

  return [

    ...PlacesUIUtils.PLACES_FLAVORS,

    ...PlacesUIUtils.URI_FLAVORS,

    "application/x-torbrowser-opaque",

  ];

});



ChromeUtils.defineLazyGetter(PlacesUIUtils, "ellipsis", function () {

browser/components/places/content/controller.js

+1 −0
Original line number Diff line number Diff line
@@ -1277,6 +1277,7 @@ PlacesController.prototype = { 
    [

      PlacesUtils.TYPE_X_MOZ_PLACE,

      PlacesUtils.TYPE_X_MOZ_URL,

      "application/x-torbrowser-opaque",

      PlacesUtils.TYPE_PLAINTEXT,

    ].forEach(type => xferable.addDataFlavor(type));

dom/base/ContentAreaDropListener.sys.mjs

+14 −2
Original line number Diff line number Diff line
@@ -2,6 +2,12 @@ 
 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */



const lazy = {};



ChromeUtils.defineESModuleGetters(lazy, {

  OpaqueDrag: "resource://gre/modules/DragDropFilter.sys.mjs",

});



// This component is used for handling dragover and drop of urls.

//

// It checks to see whether a drop of a url is allowed. For instance, a url
@@ -40,10 +46,15 @@ ContentAreaDropListener.prototype = { 
      }

    }



    type = "text/x-moz-url";

    if (types.contains(type)) {

    for (let type of ["text/x-moz-url", "application/x-torbrowser-opaque"]) {

      if (!types.contains(type)) {

        continue;

      }

      data = dt.mozGetDataAt(type, i);

      if (data) {

        if (type === "application/x-torbrowser-opaque") {

          ({ type, value: data = "" } = lazy.OpaqueDrag.retrieve(data));

        }

        let lines = data.split("\n");

        for (let i = 0, length = lines.length; i < length; i += 2) {

          this._addLink(links, lines[i], lines[i + 1], type);
@@ -236,6 +247,7 @@ ContentAreaDropListener.prototype = { 
    if (

      !types.includes("application/x-moz-file") &&

      !types.includes("text/x-moz-url") &&

      !types.includes("application/x-torbrowser-opaque") &&

      !types.includes("text/uri-list") &&

      !types.includes("text/x-moz-text-internal") &&

      !types.includes("text/plain")