0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions2

LibWeb: Restrict fetching file: and resource: URLs to internal pages

Browse source 
They are now blocked on pages which:
- Don't have an opaque origin (should be only user-initiated or about:)
- Aren't other file: pages
- Aren't other resource: pages
This commit is contained in:
circl 2024-06-10 18:06:37 +02:00 • committed by Andrew Kaster
parent d14888f31a
commit 1f3285eb04
Notes: sideshowbarker 2024-07-16 18:03:21 +09:00
1 changed files with 6 additions and 6 deletions

12
Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
View file

@ -871,20 +871,20 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> scheme_fetch(JS::Realm& r
return PendingResponse::create(vm, request, response);
}
// -> "file"
else if (request->current_url().scheme() == "file"sv) {
// AD-HOC: "resource"
else if (request->current_url().scheme() == "file"sv || request->current_url().scheme() == "resource"sv) {
// For now, unfortunate as it is, file: URLs are left as an exercise for the reader.
// When in doubt, return a network error.
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
if (request->origin().has<HTML::Origin>() && (request->origin().get<HTML::Origin>().is_opaque() || request->origin().get<HTML::Origin>().scheme() == "file"sv || request->origin().get<HTML::Origin>().scheme() == "resource"sv))
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
else
return PendingResponse::create(vm, request, Infrastructure::Response::network_error(vm, "Request with 'file:' or 'resource:' URL blocked"sv));
}
// -> HTTP(S) scheme
else if (Infrastructure::is_http_or_https_scheme(request->current_url().scheme())) {
// Return the result of running HTTP fetch given fetchParams.
return http_fetch(realm, fetch_params);
}
// AD-HOC: "resource"
else if (request->current_url().scheme() == "resource"sv) {
return TRY(nonstandard_resource_loader_file_or_http_network_fetch(realm, fetch_params));
}
// 4. Return a network error.
auto message = request->current_url().scheme() == "about"sv