firefox/CVE-2020-15665.patch

138 lines
5.1 KiB
Diff

# HG changeset patch
# User Gijs Kruitbosch <gijskruitbosch@gmail.com>
# Date 1594843114 0
# Wed Jul 15 19:58:34 2020 +0000
# Node ID 8079eea73df334803da5b07322b19d32aa8ed9e3
# Parent 8dee8cb525a2c7cff36a89be107eb50628619201
Bug 1651636 - reset the address bar when beforeunload prompts close, r=mak
Differential Revision: https://phabricator.services.mozilla.com/D83213
diff -r 8dee8cb525a2 -r 8079eea73df3 browser/actors/PromptParent.jsm
--- a/browser/actors/PromptParent.jsm Wed Jul 15 19:45:37 2020 +0000
+++ b/browser/actors/PromptParent.jsm Wed Jul 15 19:58:34 2020 +0000
@@ -169,7 +169,10 @@
this.unregisterPrompt(id);
- PromptUtils.fireDialogEvent(window, "DOMModalDialogClosed", browser);
+ PromptUtils.fireDialogEvent(window, "DOMModalDialogClosed", browser, {
+ wasPermitUnload: args.inPermitUnload,
+ areLeaving: args.ok,
+ });
resolver(args);
browser.maybeLeaveModalState();
};
diff -r 8dee8cb525a2 -r 8079eea73df3 browser/base/content/tabbrowser.js
--- a/browser/base/content/tabbrowser.js Wed Jul 15 19:45:37 2020 +0000
+++ b/browser/base/content/tabbrowser.js Wed Jul 15 19:58:34 2020 +0000
@@ -5418,6 +5418,26 @@
true
);
+ // When cancelling beforeunload tabmodal dialogs, reset the URL bar to
+ // avoid spoofing risks.
+ this.addEventListener(
+ "DOMModalDialogClosed",
+ event => {
+ if (
+ !event.detail?.wasPermitUnload ||
+ event.detail.areLeaving ||
+ event.target.nodeName != "browser"
+ ) {
+ return;
+ }
+ event.target.userTypedValue = null;
+ if (event.target == this.selectedBrowser) {
+ gURLBar.setURI();
+ }
+ },
+ true
+ );
+
let onTabCrashed = event => {
if (!event.isTrusted || !event.isTopFrame) {
return;
diff -r 8dee8cb525a2 -r 8079eea73df3 browser/base/content/test/tabPrompts/browser.ini
--- a/browser/base/content/test/tabPrompts/browser.ini Wed Jul 15 19:45:37 2020 +0000
+++ b/browser/base/content/test/tabPrompts/browser.ini Wed Jul 15 19:58:34 2020 +0000
@@ -1,3 +1,5 @@
+[browser_beforeunload_urlbar.js]
+support-files = file_beforeunload_stop.html
[browser_closeTabSpecificPanels.js]
skip-if = (verify && debug && (os == 'linux')) || (fission && os == 'linux' && bits == 64 && os_version == '18.04') # Bug 1548664
[browser_multiplePrompts.js]
diff -r 8dee8cb525a2 -r 8079eea73df3 browser/base/content/test/tabPrompts/browser_beforeunload_urlbar.js
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/browser/base/content/test/tabPrompts/browser_beforeunload_urlbar.js Wed Jul 15 19:58:34 2020 +0000
@@ -0,0 +1,57 @@
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const TEST_ROOT = getRootDirectory(gTestPath).replace(
+ "chrome://mochitests/content",
+ "http://example.com"
+);
+
+add_task(async function test_beforeunload_stay_clears_urlbar() {
+ await SpecialPowers.pushPrefEnv({
+ set: [["dom.require_user_interaction_for_beforeunload", false]],
+ });
+ const TEST_URL = TEST_ROOT + "file_beforeunload_stop.html";
+ await BrowserTestUtils.withNewTab(TEST_URL, async function(browser) {
+ gURLBar.focus();
+ const inputValue = "http://example.org/?q=typed";
+ gURLBar.inputField.value = inputValue.slice(0, -1);
+ EventUtils.sendString(inputValue.slice(-1));
+
+ let promptOpenedPromise = TestUtils.topicObserved("tabmodal-dialog-loaded");
+ EventUtils.synthesizeKey("VK_RETURN");
+ await promptOpenedPromise;
+ let promptElement = browser.parentNode.querySelector("tabmodalprompt");
+
+ // Click the cancel button
+ promptElement.querySelector(".tabmodalprompt-button1").click();
+
+ await TestUtils.waitForCondition(
+ () => promptElement.parentNode == null,
+ "tabprompt should be removed"
+ );
+ // Can't just compare directly with TEST_URL because the URL may be trimmed.
+ // Just need it to not be the example.org thing we typed in.
+ ok(
+ gURLBar.value.endsWith("_stop.html"),
+ "Url bar should be reset to point to the stop html file"
+ );
+ ok(
+ gURLBar.value.includes("example.com"),
+ "Url bar should be reset to example.com"
+ );
+ // Check the lock/identity icons are back:
+ is(
+ gURLBar.textbox.getAttribute("pageproxystate"),
+ "valid",
+ "Should be in valid pageproxy state."
+ );
+
+ // Now we need to get rid of the handler to avoid the prompt coming up when trying to close the
+ // tab when we exit `withNewTab`. :-)
+ await SpecialPowers.spawn(browser, [], function() {
+ content.window.onbeforeunload = null;
+ });
+ });
+});
diff -r 8dee8cb525a2 -r 8079eea73df3 browser/base/content/test/tabPrompts/file_beforeunload_stop.html
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/browser/base/content/test/tabPrompts/file_beforeunload_stop.html Wed Jul 15 19:58:34 2020 +0000
@@ -0,0 +1,8 @@
+<body>
+ <p>I will ask not to be closed.</p>
+ <script>
+ window.onbeforeunload = function() {
+ return "true";
+ };
+ </script>
+</body>