mirror of
https://codeberg.org/libreboot/lbmk.git
synced 2026-09-20 05:30:25 +02:00
Leah Rowe
66 lines
3.1 KiB
Diff
66 lines
3.1 KiB
Diff
From 26cad7aba0e8913d91fb1ea94d063295635e26d1 Mon Sep 17 00:00:00 2001
|
|
From: LibreWolf Developers <noreply@librewolf.net>
|
|
Date: Sun, 6 Sep 2026 10:10:12 +0100
|
|
Subject: [PATCH 17/52] limit-access.patch
|
|
|
|
---
|
|
caps/nsScriptSecurityManager.cpp | 42 ++++++++++++++++++++++++++++++++
|
|
1 file changed, 42 insertions(+)
|
|
|
|
diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
|
|
index aaca13e98a07..5a320f3279af 100644
|
|
--- a/caps/nsScriptSecurityManager.cpp
|
|
+++ b/caps/nsScriptSecurityManager.cpp
|
|
@@ -1031,6 +1031,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags(
|
|
}
|
|
}
|
|
|
|
+ // Only allow some "about:" pages to have access to contentaccessible
|
|
+ // "chrome://branding/" assets. Otherwise web pages could easily and
|
|
+ // consistently detect the differences between channels when their
|
|
+ // branding differs. See tor-browser#43308 and tor-browser#42319.
|
|
+ // NOTE: The same assets under the alternative URI
|
|
+ // "resource:///chrome/browser/content/branding/" should already be
|
|
+ // inaccessible to web content, so we only add a condition for the chrome
|
|
+ // path.
|
|
+ if (targetScheme.EqualsLiteral("chrome")) {
|
|
+ nsAutoCString targetHost;
|
|
+ rv = aTargetBaseURI->GetHost(targetHost);
|
|
+ NS_ENSURE_SUCCESS(rv, rv);
|
|
+ if (targetHost.EqualsLiteral("branding")) {
|
|
+ // Disallow any Principal whose scheme is not "about", or is a
|
|
+ // contentaccessible "about" URI ("about:blank" or "about:srcdoc").
|
|
+ // NOTE: "about:blank" and "about:srcdoc" would be unexpected here
|
|
+ // since such a document spawned by a web document should inherit the
|
|
+ // same Principal URI. I.e. they would be "http:" or "https:" schemes.
|
|
+ // But we add this condition for extra assurances.
|
|
+ // NOTE: Documents with null Principals, like "about:blank" typed by
|
|
+ // the user, would also be excluded since the Principal URI would be
|
|
+ // "moz-nullprincipal:".
|
|
+ if (!aSourceBaseURI->SchemeIs("about") ||
|
|
+ NS_IsContentAccessibleAboutURI(aSourceBaseURI)) {
|
|
+ return NS_ERROR_DOM_BAD_URI;
|
|
+ }
|
|
+ // Also exclude "about:reader" from accessing branding assets. I.e. if
|
|
+ // a web page includes `<img src="chrome://branding/..." />` we do not
|
|
+ // want it to render within "about:reader" either.
|
|
+ // Though it is unknown whether the information within "about:reader"
|
|
+ // would be exploitable by a web page, we also want to exclude
|
|
+ // "about:reader" for consistency: if it does not display in the
|
|
+ // original web page, it should not display in "about:reader" either.
|
|
+ nsAutoCString sourcePath;
|
|
+ rv = aSourceBaseURI->GetFilePath(sourcePath);
|
|
+ NS_ENSURE_SUCCESS(rv, rv);
|
|
+ if (sourcePath.EqualsLiteral("reader")) {
|
|
+ return NS_ERROR_DOM_BAD_URI;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
if (targetScheme.EqualsLiteral("resource")) {
|
|
if (StaticPrefs::security_all_resource_uri_content_accessible()) {
|
|
return NS_OK;
|
|
--
|
|
2.47.3
|
|
|