335335 - Fix string URI consumers to use CheckLoadURIStr

Status: RESOLVED INVALID

(SeaMonkey :: General, defect)

Description

[Boris Zbarsky [:bzbarsky]]

At least the following consumers in Seamonkey code use CheckLoadURI for strings, which we've discovered (in bug 334341) is unsafe:

<method name="onLinkAdded"> in tabbrowser.xml

These should probably be switched to CheckLoadURIStr or something...  And other consumers of CheckLoadURI should be checked over.

Comment 1

[Robert Kaiser]

We certainly want this fixed for any upcoming release, esp. security releases :)

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

http://developer.mozilla.org/en/docs/Safely_loading_URIs has some information about this. Basically, everything that ends up loading URIs via a docshell should use checkLoadURIStr instead of checkLoadURI to ensure that the fixed up URI is also checked.

Comment 3

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: patch

My best guess (well, the other option is to pass href directly, but if we use the uri for the load, might as well use its spec).

Comment 4

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: v2

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 221776 [details] [diff] [review]
v2

I'm not a peer for this code.  Please don't ask me for review on UI patches, in general...

Comment 6

[[e-mail]]

(In reply to comment #2)
>Basically, everything that ends up loading URIs via a docshell should use
>checkLoadURIStr instead of checkLoadURI
Except this URI isn't loading via a docshell, it's the source of an image.
bz: feel free to reopen if I've misunderstood this bug.

Comment 7

[Boris Zbarsky [:bzbarsky]]

No, if this is loading an image then it's fine.