GitLab

at 2025-03-02T23:38:07+01:00

Bug 1908488 - Improve dialogs. r=android-reviewers,gmalekpour, a=dmeehan [bp]

Differential Revision: https://phabricator.services.mozilla.com/D236606

Bug 1922357 - disallow the fido: URI scheme.  a=dmeehan

Original Revision: https://phabricator.services.mozilla.com/D237313

Differential Revision: https://phabricator.services.mozilla.com/D238681
Bug 1928334 - Handles animating activities  a=dmeehan

Original Revision: https://phabricator.services.mozilla.com/D238342

Differential Revision: https://phabricator.services.mozilla.com/D238845
Bug 1942022 - Improve the about:protections CSP. r=firefox-desktop-core-reviewers ,mossop

Differential Revision: https://phabricator.services.mozilla.com/D234507
Bug 1942025 - Improve the about:privatebrowsing CSP. r=firefox-desktop-core-reviewers ,Gijs

Differential Revision: https://phabricator.services.mozilla.com/D234508
     <meta charset="utf-8" />

     <meta

       http-equiv="Content-Security-Policy"

-      content="default-src chrome: blob:; object-src 'none'"

+      content="default-src chrome:; img-src chrome: blob:; object-src 'none';"

     />

     <meta name="color-scheme" content="light dark" />

     <link rel="icon" href="chrome://browser/skin/privatebrowsing/favicon.svg" />

     <meta charset="utf-8" />

     <meta

       http-equiv="Content-Security-Policy"

-      content="default-src chrome: blob:; object-src 'none'"

+      content="default-src chrome:; object-src 'none'"

     />

     <meta name="color-scheme" content="light dark" />

     <link rel="localization" href="branding/brand.ftl" />

         internal const val ABOUT_BLANK = "about:blank"

         internal const val JS_SCHEME = "javascript"

         internal val BLOCKED_SCHEMES =

-            listOf("file", "resource", JS_SCHEME) // See 1684761 and 1684947

+            listOf("file", "resource", "fido", JS_SCHEME) // See 1684761 and 1684947

         /**

          * Provides an ErrorType corresponding to the error code provided.

         engineSession.loadUrl("RESOURCE://package/test.text")

         verify(geckoSession, never()).load(GeckoSession.Loader().uri("resource://package/test.text"))

         verify(geckoSession, never()).load(GeckoSession.Loader().uri("RESOURCE://package/test.text"))

+

+        engineSession.loadUrl("fido:/12345678")

+        engineSession.loadUrl("FIDO:/12345678")

+        verify(geckoSession, never()).load(GeckoSession.Loader().uri("fido:/12345678"))

+        verify(geckoSession, never()).load(GeckoSession.Loader().uri("FIDO:/12345678"))

     }

     @Test

             "https", "moz-extension", "moz-safe-about", "resource", "view-source", "ws", "wss", "blob",

         )

-        internal val ALWAYS_DENY_SCHEMES: Set<String> = setOf("jar", "file", "javascript", "data", "about", "content")

+        internal val ALWAYS_DENY_SCHEMES: Set<String> =

+            setOf("jar", "file", "javascript", "data", "about", "content", "fido")

     }

 }
     private val javascriptUrl = "javascript:'hello, world'"

     private val jarUrl = "jar:file://some/path/test.html"

     private val contentUrl = "content://media/external_primary/downloads/12345"

+    private val fidoPath = "fido:12345678"

     private val fileType = "audio/mpeg"

     private val layerUrl = "https://example.com"

     private val layerPackage = "com.example.app"

         assertFalse(redirect.isRedirect())

     }

+    @Test

+    fun `A fido url is not an app link`() {

+        val context = createContext(Triple(fidoPath, appPackage, ""))

+        val subject = AppLinksUseCases(context, { true })

+

+        val redirect = subject.interceptedAppLinkRedirect(fidoPath)

+        assertFalse(redirect.isRedirect())

+    }

+

     @Test

     fun `Will not redirect app link if browser option set to false and scheme is supported`() {

         val context = createContext(Triple(appUrl, appPackage, ""))

 import androidx.annotation.VisibleForTesting

 import androidx.annotation.VisibleForTesting.Companion.PRIVATE

 import androidx.core.view.isVisible

+import androidx.fragment.app.DialogFragment

 import androidx.fragment.app.Fragment

 import androidx.fragment.app.FragmentManager

 import kotlinx.coroutines.CoroutineScope

         emitPromptDismissedFact(promptName = promptRequest::class.simpleName.ifNullOrEmpty { "" })

     }

+    @VisibleForTesting

+    internal fun redirectDialogFragmentIsActive() =

+        (fragmentManager.findFragmentByTag("SHOULD_OPEN_APP_LINK_PROMPT_DIALOG") as? DialogFragment) != null

+

     private fun canShowThisPrompt(promptRequest: PromptRequest): Boolean {

+        if (redirectDialogFragmentIsActive()) {

+            return false

+        }

+

         return when (promptRequest) {

             is SingleChoice,

             is MultipleChoice,

         return false

     }

-    final override fun dispatchTouchEvent(ev: MotionEvent?): Boolean {

+    override fun dispatchTouchEvent(ev: MotionEvent?): Boolean {

         ProfilerMarkers.addForDispatchTouchEvent(components.core.engine.profiler, ev)

         return super.dispatchTouchEvent(ev)

     }

 import android.app.assist.AssistContent

 import android.net.Uri

 import android.os.Build

+import android.view.MotionEvent

 import androidx.annotation.RequiresApi

 import androidx.annotation.VisibleForTesting

 import mozilla.components.browser.state.selector.findCustomTab

  */

 @Suppress("TooManyFunctions")

 open class ExternalAppBrowserActivity : HomeActivity() {

+    var isFinishedAnimating = false

+

     override fun onResume() {

         super.onResume()

         val currentTabUrl = getExternalTab()?.content?.url

         outContent?.webUri = currentTabUrl?.let { Uri.parse(it) }

     }

+

+    override fun dispatchTouchEvent(ev: MotionEvent?): Boolean {

+        if (!isFinishedAnimating) {

+            return true

+        }

+

+        return super.dispatchTouchEvent(ev)

+    }

+

+    override fun onEnterAnimationComplete() {

+        super.onEnterAnimationComplete()

+        isFinishedAnimating = true

+    }

 }
       return getSafeIntent(aUri) != null;

     }

+    if ("fido".equals(scheme)) {

+      return false;

+    }

+

     return true;

   }

     final String uri = "intent:non_scheme_intent#Intent;end";

     assertTrue(IntentUtils.isUriSafeForScheme(uri));

   }

+

+  @Test

+  public void unsafeFidoUri() {

+    final String uri = "fido:/12345678";

+    assertFalse(IntentUtils.isUriSafeForScheme(uri));

+  }

 }

...	...	@@ -314,6 +314,7 @@ class AppLinksUseCases(
314	314	"https", "moz-extension", "moz-safe-about", "resource", "view-source", "ws", "wss", "blob",
315	315	)
316	316
317		- internal val ALWAYS_DENY_SCHEMES: Set<String> = setOf("jar", "file", "javascript", "data", "about", "content")
	317	+ internal val ALWAYS_DENY_SCHEMES: Set<String> =
	318	+ setOf("jar", "file", "javascript", "data", "about", "content", "fido")
318	319	}
319	320	}

...	...	@@ -903,7 +903,7 @@ open class HomeActivity : LocaleAwareAppCompatActivity(), NavHostActivity, TorIn
903	903	return false
904	904	}
905	905
906		- final override fun dispatchTouchEvent(ev: MotionEvent?): Boolean {
	906	+ override fun dispatchTouchEvent(ev: MotionEvent?): Boolean {
907	907	ProfilerMarkers.addForDispatchTouchEvent(components.core.engine.profiler, ev)
908	908	return super.dispatchTouchEvent(ev)
909	909	}

ma1 pushed to branch tor-browser-128.8.0esr-14.0-1 at The Tor Project / Applications / Tor Browser

Commits:

11 changed files:

Changes:

...	...	@@ -76,6 +76,10 @@ public class IntentUtils {
76	76	return getSafeIntent(aUri) != null;
77	77	}
78	78
	79	+ if ("fido".equals(scheme)) {
	80	+ return false;
	81	+ }
	82	+
79	83	return true;
80	84	}
81	85