1 Star 0 Fork 53

src-oepkgs-oE-rv/firefox

forked from src-openEuler/firefox 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
CVE-2020-26956-2.patch 6.47 KB
一键复制 编辑 原始数据 按行查看 历史
wangxiao65 提交于 2021-01-07 15:15 . fix cves
# HG changeset patch
# User Henri Sivonen <[email protected]>
# Date 1603457332 0
# Fri Oct 23 12:48:52 2020 +0000
# Node ID b067b0d3670b37daad95505b87bddca6bb113d11
# Parent 3476387362fb15c82f133f390afef719ad36de0a
Bug 1666300 part 2 - Parse into an inert document. r=smaug
Differential Revision: https://phabricator.services.mozilla.com/D93478
diff -r 3476387362fb -r b067b0d3670b dom/base/nsContentUtils.cpp
--- a/dom/base/nsContentUtils.cpp Fri Oct 23 12:48:49 2020 +0000
+++ b/dom/base/nsContentUtils.cpp Fri Oct 23 12:48:52 2020 +0000
@@ -4968,17 +4968,12 @@
nsAString& aResultBuffer,
uint32_t aFlags,
uint32_t aWrapCol) {
- nsCOMPtr<nsIURI> uri;
- NS_NewURI(getter_AddRefs(uri), "about:blank");
- nsCOMPtr<nsIPrincipal> principal =
- NullPrincipal::CreateWithoutOriginAttributes();
- RefPtr<Document> document;
- nsresult rv = NS_NewDOMDocument(getter_AddRefs(document), EmptyString(),
- EmptyString(), nullptr, uri, uri, principal,
- true, nullptr, DocumentFlavorHTML);
- NS_ENSURE_SUCCESS(rv, rv);
-
- rv = nsContentUtils::ParseDocumentHTML(
+ RefPtr<Document> document = nsContentUtils::CreateInertHTMLDocument(nullptr);
+ if (!document) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsresult rv = nsContentUtils::ParseDocumentHTML(
aSourceBuffer, document,
!(aFlags & nsIDocumentEncoder::OutputNoScriptContent));
NS_ENSURE_SUCCESS(rv, rv);
@@ -4994,6 +4989,58 @@
}
/* static */
+already_AddRefed<Document> nsContentUtils::CreateInertXMLDocument(
+ const Document* aTemplate) {
+ return nsContentUtils::CreateInertDocument(aTemplate, DocumentFlavorXML);
+}
+
+/* static */
+already_AddRefed<Document> nsContentUtils::CreateInertHTMLDocument(
+ const Document* aTemplate) {
+ return nsContentUtils::CreateInertDocument(aTemplate, DocumentFlavorHTML);
+}
+
+/* static */
+already_AddRefed<Document> nsContentUtils::CreateInertDocument(
+ const Document* aTemplate, DocumentFlavor aFlavor) {
+ if (aTemplate) {
+ bool hasHad = true;
+ nsIScriptGlobalObject* sgo = aTemplate->GetScriptHandlingObject(hasHad);
+ NS_ENSURE_TRUE(sgo || !hasHad, nullptr);
+
+ nsCOMPtr<Document> doc;
+ nsresult rv = NS_NewDOMDocument(
+ getter_AddRefs(doc), NS_LITERAL_STRING(""), NS_LITERAL_STRING(""), nullptr,
+ aTemplate->GetDocumentURI(), aTemplate->GetDocBaseURI(),
+ aTemplate->NodePrincipal(), true, sgo, aFlavor);
+ if (NS_FAILED(rv)) {
+ return nullptr;
+ }
+ return doc.forget();
+ }
+ nsCOMPtr<nsIURI> uri;
+ NS_NewURI(getter_AddRefs(uri), NS_LITERAL_CSTRING("about:blank"));
+ if (!uri) {
+ return nullptr;
+ }
+
+ RefPtr<NullPrincipal> nullPrincipal =
+ NullPrincipal::CreateWithoutOriginAttributes();
+ if (!nullPrincipal) {
+ return nullptr;
+ }
+
+ nsCOMPtr<Document> doc;
+ nsresult rv =
+ NS_NewDOMDocument(getter_AddRefs(doc), NS_LITERAL_STRING(""), NS_LITERAL_STRING(""), nullptr, uri, uri,
+ nullPrincipal, true, nullptr, aFlavor);
+ if (NS_FAILED(rv)) {
+ return nullptr;
+ }
+ return doc.forget();
+}
+
+/* static */
nsresult nsContentUtils::SetNodeTextContent(nsIContent* aContent,
const nsAString& aValue,
bool aTryReuse) {
diff -r 3476387362fb -r b067b0d3670b dom/base/nsContentUtils.h
--- a/dom/base/nsContentUtils.h Fri Oct 23 12:48:49 2020 +0000
+++ b/dom/base/nsContentUtils.h Fri Oct 23 12:48:52 2020 +0000
@@ -1831,6 +1831,25 @@
uint32_t aWrapCol);
/**
+ * Creates a 'loaded-as-data' HTML document that takes that principal,
+ * script global, and URL from the argument, which may be null.
+ */
+ static already_AddRefed<Document> CreateInertHTMLDocument(
+ const Document* aTemplate);
+
+ /**
+ * Creates a 'loaded-as-data' XML document that takes that principal,
+ * script global, and URL from the argument, which may be null.
+ */
+ static already_AddRefed<Document> CreateInertXMLDocument(
+ const Document* aTemplate);
+
+ private:
+ static already_AddRefed<Document> CreateInertDocument(
+ const Document* aTemplate, DocumentFlavor aFlavor);
+
+ public:
+ /**
* Sets the text contents of a node by replacing all existing children
* with a single text child.
*
diff -r 3476387362fb -r b067b0d3670b editor/libeditor/HTMLEditorDataTransfer.cpp
--- a/editor/libeditor/HTMLEditorDataTransfer.cpp Fri Oct 23 12:48:49 2020 +0000
+++ b/editor/libeditor/HTMLEditorDataTransfer.cpp Fri Oct 23 12:48:52 2020 +0000
@@ -3039,8 +3039,13 @@
bool aTrustedInput) {
nsAutoScriptBlockerSuppressNodeRemoved autoBlocker;
- RefPtr<DocumentFragment> fragment = new (aTargetDocument->NodeInfoManager())
- DocumentFragment(aTargetDocument->NodeInfoManager());
+ nsCOMPtr<Document> doc =
+ nsContentUtils::CreateInertHTMLDocument(aTargetDocument);
+ if (!doc) {
+ return NS_ERROR_FAILURE;
+ }
+ RefPtr<DocumentFragment> fragment =
+ new (doc->NodeInfoManager()) DocumentFragment(doc->NodeInfoManager());
nsresult rv = nsContentUtils::ParseFragmentHTML(
aFragStr, fragment,
aContextLocalName ? aContextLocalName : nsGkAtoms::body,
diff -r 3476387362fb -r b067b0d3670b parser/html/nsParserUtils.cpp
--- a/parser/html/nsParserUtils.cpp Fri Oct 23 12:48:49 2020 +0000
+++ b/parser/html/nsParserUtils.cpp Fri Oct 23 12:48:52 2020 +0000
@@ -45,17 +45,13 @@
NS_IMETHODIMP
nsParserUtils::Sanitize(const nsAString& aFromStr, uint32_t aFlags,
nsAString& aToStr) {
- nsCOMPtr<nsIURI> uri;
- NS_NewURI(getter_AddRefs(uri), "about:blank");
- nsCOMPtr<nsIPrincipal> principal =
- mozilla::NullPrincipal::CreateWithoutOriginAttributes();
- RefPtr<Document> document;
- nsresult rv = NS_NewDOMDocument(getter_AddRefs(document), EmptyString(),
- EmptyString(), nullptr, uri, uri, principal,
- true, nullptr, DocumentFlavorHTML);
- NS_ENSURE_SUCCESS(rv, rv);
+ RefPtr<Document> document = nsContentUtils::CreateInertHTMLDocument(nullptr);
- rv = nsContentUtils::ParseDocumentHTML(aFromStr, document, false);
+ if (!document) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsresult rv = nsContentUtils::ParseDocumentHTML(aFromStr, document, false);
NS_ENSURE_SUCCESS(rv, rv);
nsTreeSanitizer sanitizer(aFlags);
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/src-oepkgs-oe-rv/firefox.git
[email protected]:src-oepkgs-oe-rv/firefox.git
src-oepkgs-oe-rv
firefox
firefox
master

搜索帮助