LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-08-16 17:00:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Restrict fetching file: and resource: URLs to internal pages

Browse Source 
They are now blocked on pages which:
- Don't have an opaque origin (should be only user-initiated or about:)
- Aren't other file: pages
- Aren't other resource: pages
This commit is contained in:
circl 2024-06-10 18:06:37 +02:00 committed by Andrew Kaster
parent d14888f31a
commit 1f3285eb04
Notes: sideshowbarker 2024-07-16 18:03:21 +09:00 
Author: https://github.com/circl-lastname
Commit: https://github.com/LadybirdBrowser/ladybird/commit/1f3285eb04
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/129
Reviewed-by: https://github.com/ADKaster ✅
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
View File

@ -871,20 +871,20 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> scheme_fetch(JS::Realm& r
return PendingResponse::create(vm, request, response);
}
// -> "file"
else if (request->current_url().scheme() == "file"sv) {
// AD-HOC: "resource"
else if (request->current_url().scheme() == "file"sv || request->current_url().scheme() == "resource"sv) {
// For now, unfortunate as it is, file: URLs are left as an exercise for the reader.
// When in doubt, return a network error.
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
if (request->origin().has<HTML::Origin>() && (request->origin().get<HTML::Origin>().is_opaque() || request->origin().get<HTML::Origin>().scheme() == "file"sv || request->origin().get<HTML::Origin>().scheme() == "resource"sv))
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
else
return PendingResponse::create(vm, request, Infrastructure::Response::network_error(vm, "Request with 'file:' or 'resource:' URL blocked"sv));
}
// -> HTTP(S) scheme
else if (Infrastructure::is_http_or_https_scheme(request->current_url().scheme())) {
// Return the result of running HTTP fetch given fetchParams.
return http_fetch(realm, fetch_params);
}
// AD-HOC: "resource"
else if (request->current_url().scheme() == "resource"sv) {
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
}
// 4. Return a network error.
auto message = request->current_url().scheme() == "about"sv