[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][base-browser-128.1.0esr-14.0-1] Bug 42835: Create an actor to filter file data transfers

Title: GitLab

ma1 pushed to branch base-browser-128.1.0esr-14.0-1 at The Tor Project / Applications / Tor Browser

Commits:

  • ac2dbd4d
    by hackademix at 2024-08-02T22:23:38+02:00 
    Bug 42835: Create an actor to filter file data transfers

4 changed files:

Changes:

  • toolkit/actors/FilesFilterChild.sys.mjs
    1 
    +/* This Source Code Form is subject to the terms of the Mozilla Public
    2 
    + * License, v. 2.0. If a copy of the MPL was not distributed with this
    3 
    + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
    4 
    +
    5 
    +const lazy = {};
    6 
    +
    7 
    +ChromeUtils.defineLazyGetter(lazy, "console", () => {
    8 
    +  return console.createInstance({
    9 
    +    prefix: "FilesFilter",
    10 
    +  });
    11 
    +});
    12 
    +
    13 
    +export class FilesFilterChild extends JSWindowActorChild {
    14 
    +  handleEvent(event) {
    15 
    +    // drop or paste
    16 
    +    const { composedTarget } = event;
    17 
    +    const dt = event.clipboardData || event.dataTransfer;
    18 
    +
    19 
    +    if (dt.files.length) {
    20 
    +      if (
    21 
    +        ["HTMLInputElement", "HTMLTextAreaElement"].includes(
    22 
    +          ChromeUtils.getClassName(composedTarget)
    23 
    +        )
    24 
    +      ) {
    25 
    +        event.preventDefault();
    26 
    +        lazy.console.log(
    27 
    +          `Preventing path leak on ${event.type} for ${[...dt.files]
    28 
    +            .map(f => f.name)
    29 
    +            .join(", ")}.`
    30 
    +        );
    31 
    +      }
    32 
    +      return;
    33 
    +    }
    34 
    +
    35 
    +    // "Paste Without Formatting" (ctrl+shift+V) in HTML editors coerces files into paths
    36 
    +    if (!(event.clipboardData && dt.getData("text"))) {
    37 
    +      return;
    38 
    +    }
    39 
    +
    40 
    +    // check wether the clipboard contains a file
    41 
    +    const { clipboard } = Services;
    42 
    +    if (
    43 
    +      [clipboard.kSelectionClipboard, clipboard.kGlobalClipboard].some(
    44 
    +        clipboardType =>
    45 
    +          clipboard.isClipboardTypeSupported(clipboardType) &&
    46 
    +          clipboard.hasDataMatchingFlavors(
    47 
    +            ["application/x-moz-file"],
    48 
    +            clipboardType
    49 
    +          )
    50 
    +      )
    51 
    +    ) {
    52 
    +      event.preventDefault();
    53 
    +      event.stopPropagation();
    54 
    +      lazy.console.log(
    55 
    +        `Preventing path leak on "Paste Without Formatting" for ${dt.getData(
    56 
    +          "text"
    57 
    +        )}.`
    58 
    +      );
    59 
    +    }
    60 
    +  }
    61 
    +}

  • toolkit/actors/FilesFilterParent.sys.mjs
    1 
    +/* This Source Code Form is subject to the terms of the Mozilla Public
    2 
    + * License, v. 2.0. If a copy of the MPL was not distributed with this
    3 
    + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
    4 
    +
    5 
    +export class FilesFilterParent extends JSWindowActorParent {
    6 
    +  // just a stub for now
    7 
    +}

  • toolkit/actors/moz.build
    ... ... @@ -53,6 +53,8 @@ FINAL_TARGET_FILES.actors += [
    53 53 
         "DateTimePickerChild.sys.mjs",
    54 54 
         "DateTimePickerParent.sys.mjs",
    55 55 
         "ExtFindChild.sys.mjs",
    56 
    +    "FilesFilterChild.sys.mjs",
    57 
    +    "FilesFilterParent.sys.mjs",
    56 58 
         "FindBarChild.sys.mjs",
    57 59 
         "FindBarParent.sys.mjs",
    58 60 
         "FinderChild.sys.mjs",

  • toolkit/modules/ActorManagerParent.sys.mjs
    ... ... @@ -285,6 +285,22 @@ let JSWINDOWACTORS = {
    285 285 
         allFrames: true,
    286 286 
       },
    287 287
    288 
    +  FilesFilter: {
    289 
    +    parent: {
    290 
    +      esModuleURI: "resource://gre/actors/FilesFilterParent.sys.mjs",
    291 
    +    },
    292 
    +
    293 
    +    child: {
    294 
    +      esModuleURI: "resource://gre/actors/FilesFilterChild.sys.mjs",
    295 
    +      events: {
    296 
    +        drop: {},
    297 
    +        paste: { capture: true },
    298 
    +      },
    299 
    +    },
    300 
    +
    301 
    +    allFrames: true,
    302 
    +  },
    303 
    +
    288 304 
       FindBar: {
    289 305 
         parent: {
    290 306 
           esModuleURI: "resource://gre/actors/FindBarParent.sys.mjs",

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits