1172701 - GetSubresourceURI should properly compute the resource path

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Valentin Gosu [:valentin] (he/him)]

Currently, the resource path is simply appended to the package path.
We should make sure the path is normalized, and that it can't escape the package's namespace.

Comment 1

[Valentin Gosu [:valentin] (he/him)]

Attachment: Make GetSubresourceURI normalize the path for packaged resources

Comment 2

[Patrick McManus [:mcmanus]]

Comment on attachment 8646110 [details] [diff] [review]
Make GetSubresourceURI normalize the path for packaged resources

Review of attachment 8646110 [details] [diff] [review]:
-----------------------------------------------------------------

::: netwerk/protocol/http/PackagedAppService.cpp
@@ +337,5 @@
> +  {
> +    // We use this temp URI to generate a path that is relative
> +    // to the package URI and not to the root of the domain.
> +    nsCOMPtr<nsIURI> tempURI;
> +    NS_NewURI(getter_AddRefs(tempURI), "http://temp-domain/");

temp-domain.local - jic

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/846e76b0e711

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/846e76b0e711