ma1 pushed to branch base-browser-115.14.0esr-13.5-1 at The Tor Project / Applications / Tor Browser
Commits:
-
aa9b979b
by hackademix at 2024-08-05T09:09:37+02:00
4 changed files:
- + toolkit/actors/FilesFilterChild.sys.mjs
- + toolkit/actors/FilesFilterParent.sys.mjs
- toolkit/actors/moz.build
- toolkit/modules/ActorManagerParent.sys.mjs
Changes:
| 1 | +/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
| 2 | + * License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
| 3 | + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
| 4 | + |
|
| 5 | +const lazy = {};
|
|
| 6 | + |
|
| 7 | +ChromeUtils.defineLazyGetter(lazy, "console", () => {
|
|
| 8 | + return console.createInstance({
|
|
| 9 | + prefix: "FilesFilter",
|
|
| 10 | + });
|
|
| 11 | +});
|
|
| 12 | + |
|
| 13 | +export class FilesFilterChild extends JSWindowActorChild {
|
|
| 14 | + handleEvent(event) {
|
|
| 15 | + // drop or paste
|
|
| 16 | + const { composedTarget } = event;
|
|
| 17 | + const dt = event.clipboardData || event.dataTransfer;
|
|
| 18 | + |
|
| 19 | + if (dt.files.length) {
|
|
| 20 | + if (
|
|
| 21 | + ["HTMLInputElement", "HTMLTextAreaElement"].includes(
|
|
| 22 | + ChromeUtils.getClassName(composedTarget)
|
|
| 23 | + )
|
|
| 24 | + ) {
|
|
| 25 | + event.preventDefault();
|
|
| 26 | + lazy.console.log(
|
|
| 27 | + `Preventing path leak on ${event.type} for ${[...dt.files]
|
|
| 28 | + .map(f => f.name)
|
|
| 29 | + .join(", ")}.`
|
|
| 30 | + );
|
|
| 31 | + }
|
|
| 32 | + return;
|
|
| 33 | + }
|
|
| 34 | + |
|
| 35 | + // "Paste Without Formatting" (ctrl+shift+V) in HTML editors coerces files into paths
|
|
| 36 | + if (!(event.clipboardData && dt.getData("text"))) {
|
|
| 37 | + return;
|
|
| 38 | + }
|
|
| 39 | + |
|
| 40 | + // check wether the clipboard contains a file
|
|
| 41 | + const { clipboard } = Services;
|
|
| 42 | + if (
|
|
| 43 | + [clipboard.kSelectionClipboard, clipboard.kGlobalClipboard].some(
|
|
| 44 | + clipboardType =>
|
|
| 45 | + clipboard.isClipboardTypeSupported(clipboardType) &&
|
|
| 46 | + clipboard.hasDataMatchingFlavors(
|
|
| 47 | + ["application/x-moz-file"],
|
|
| 48 | + clipboardType
|
|
| 49 | + )
|
|
| 50 | + )
|
|
| 51 | + ) {
|
|
| 52 | + event.preventDefault();
|
|
| 53 | + event.stopPropagation();
|
|
| 54 | + lazy.console.log(
|
|
| 55 | + `Preventing path leak on "Paste Without Formatting" for ${dt.getData(
|
|
| 56 | + "text"
|
|
| 57 | + )}.`
|
|
| 58 | + );
|
|
| 59 | + }
|
|
| 60 | + }
|
|
| 61 | +} |
| 1 | +/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
| 2 | + * License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
| 3 | + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
| 4 | + |
|
| 5 | +export class FilesFilterParent extends JSWindowActorParent {
|
|
| 6 | + // just a stub for now
|
|
| 7 | +} |
| ... | ... | @@ -55,6 +55,8 @@ FINAL_TARGET_FILES.actors += [ |
| 55 | 55 | "DateTimePickerChild.sys.mjs",
|
| 56 | 56 | "DateTimePickerParent.sys.mjs",
|
| 57 | 57 | "ExtFindChild.sys.mjs",
|
| 58 | + "FilesFilterChild.sys.mjs",
|
|
| 59 | + "FilesFilterParent.sys.mjs",
|
|
| 58 | 60 | "FindBarChild.sys.mjs",
|
| 59 | 61 | "FindBarParent.sys.mjs",
|
| 60 | 62 | "FinderChild.sys.mjs",
|
| ... | ... | @@ -244,6 +244,22 @@ let JSWINDOWACTORS = { |
| 244 | 244 | allFrames: true,
|
| 245 | 245 | },
|
| 246 | 246 | |
| 247 | + FilesFilter: {
|
|
| 248 | + parent: {
|
|
| 249 | + esModuleURI: "resource://gre/actors/FilesFilterParent.sys.mjs",
|
|
| 250 | + },
|
|
| 251 | + |
|
| 252 | + child: {
|
|
| 253 | + esModuleURI: "resource://gre/actors/FilesFilterChild.sys.mjs",
|
|
| 254 | + events: {
|
|
| 255 | + drop: {},
|
|
| 256 | + paste: { capture: true },
|
|
| 257 | + },
|
|
| 258 | + },
|
|
| 259 | + |
|
| 260 | + allFrames: true,
|
|
| 261 | + },
|
|
| 262 | + |
|
| 247 | 263 | FindBar: {
|
| 248 | 264 | parent: {
|
| 249 | 265 | esModuleURI: "resource://gre/actors/FindBarParent.sys.mjs",
|