ma1 pushed to branch mullvad-browser-128.1.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser
Commits:
-
dccbed9e
by hackademix at 2024-08-02T22:26:22+02:00
4 changed files:
- + toolkit/actors/FilesFilterChild.sys.mjs
- + toolkit/actors/FilesFilterParent.sys.mjs
- toolkit/actors/moz.build
- toolkit/modules/ActorManagerParent.sys.mjs
Changes:
| 1 | +/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
| 2 | + * License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
| 3 | + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
| 4 | + |
|
| 5 | +const lazy = {};
|
|
| 6 | + |
|
| 7 | +ChromeUtils.defineLazyGetter(lazy, "console", () => {
|
|
| 8 | + return console.createInstance({
|
|
| 9 | + prefix: "FilesFilter",
|
|
| 10 | + });
|
|
| 11 | +});
|
|
| 12 | + |
|
| 13 | +export class FilesFilterChild extends JSWindowActorChild {
|
|
| 14 | + handleEvent(event) {
|
|
| 15 | + // drop or paste
|
|
| 16 | + const { composedTarget } = event;
|
|
| 17 | + const dt = event.clipboardData || event.dataTransfer;
|
|
| 18 | + |
|
| 19 | + if (dt.files.length) {
|
|
| 20 | + if (
|
|
| 21 | + ["HTMLInputElement", "HTMLTextAreaElement"].includes(
|
|
| 22 | + ChromeUtils.getClassName(composedTarget)
|
|
| 23 | + )
|
|
| 24 | + ) {
|
|
| 25 | + event.preventDefault();
|
|
| 26 | + lazy.console.log(
|
|
| 27 | + `Preventing path leak on ${event.type} for ${[...dt.files]
|
|
| 28 | + .map(f => f.name)
|
|
| 29 | + .join(", ")}.`
|
|
| 30 | + );
|
|
| 31 | + }
|
|
| 32 | + return;
|
|
| 33 | + }
|
|
| 34 | + |
|
| 35 | + // "Paste Without Formatting" (ctrl+shift+V) in HTML editors coerces files into paths
|
|
| 36 | + if (!(event.clipboardData && dt.getData("text"))) {
|
|
| 37 | + return;
|
|
| 38 | + }
|
|
| 39 | + |
|
| 40 | + // check wether the clipboard contains a file
|
|
| 41 | + const { clipboard } = Services;
|
|
| 42 | + if (
|
|
| 43 | + [clipboard.kSelectionClipboard, clipboard.kGlobalClipboard].some(
|
|
| 44 | + clipboardType =>
|
|
| 45 | + clipboard.isClipboardTypeSupported(clipboardType) &&
|
|
| 46 | + clipboard.hasDataMatchingFlavors(
|
|
| 47 | + ["application/x-moz-file"],
|
|
| 48 | + clipboardType
|
|
| 49 | + )
|
|
| 50 | + )
|
|
| 51 | + ) {
|
|
| 52 | + event.preventDefault();
|
|
| 53 | + event.stopPropagation();
|
|
| 54 | + lazy.console.log(
|
|
| 55 | + `Preventing path leak on "Paste Without Formatting" for ${dt.getData(
|
|
| 56 | + "text"
|
|
| 57 | + )}.`
|
|
| 58 | + );
|
|
| 59 | + }
|
|
| 60 | + }
|
|
| 61 | +} |
| 1 | +/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
| 2 | + * License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
| 3 | + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
| 4 | + |
|
| 5 | +export class FilesFilterParent extends JSWindowActorParent {
|
|
| 6 | + // just a stub for now
|
|
| 7 | +} |
| ... | ... | @@ -53,6 +53,8 @@ FINAL_TARGET_FILES.actors += [ |
| 53 | 53 | "DateTimePickerChild.sys.mjs",
|
| 54 | 54 | "DateTimePickerParent.sys.mjs",
|
| 55 | 55 | "ExtFindChild.sys.mjs",
|
| 56 | + "FilesFilterChild.sys.mjs",
|
|
| 57 | + "FilesFilterParent.sys.mjs",
|
|
| 56 | 58 | "FindBarChild.sys.mjs",
|
| 57 | 59 | "FindBarParent.sys.mjs",
|
| 58 | 60 | "FinderChild.sys.mjs",
|
| ... | ... | @@ -285,6 +285,22 @@ let JSWINDOWACTORS = { |
| 285 | 285 | allFrames: true,
|
| 286 | 286 | },
|
| 287 | 287 | |
| 288 | + FilesFilter: {
|
|
| 289 | + parent: {
|
|
| 290 | + esModuleURI: "resource://gre/actors/FilesFilterParent.sys.mjs",
|
|
| 291 | + },
|
|
| 292 | + |
|
| 293 | + child: {
|
|
| 294 | + esModuleURI: "resource://gre/actors/FilesFilterChild.sys.mjs",
|
|
| 295 | + events: {
|
|
| 296 | + drop: {},
|
|
| 297 | + paste: { capture: true },
|
|
| 298 | + },
|
|
| 299 | + },
|
|
| 300 | + |
|
| 301 | + allFrames: true,
|
|
| 302 | + },
|
|
| 303 | + |
|
| 288 | 304 | FindBar: {
|
| 289 | 305 | parent: {
|
| 290 | 306 | esModuleURI: "resource://gre/actors/FindBarParent.sys.mjs",
|