diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp --- a/docshell/base/nsAboutRedirector.cpp +++ b/docshell/base/nsAboutRedirector.cpp @@ -5,10 +5,11 @@ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "nsAboutRedirector.h" #include "nsNetUtil.h" #include "nsAboutProtocolUtils.h" +#include "nsBaseChannel.h" #include "mozilla/ArrayUtils.h" #include "nsIProtocolHandler.h" NS_IMPL_ISUPPORTS(nsAboutRedirector, nsIAboutModule) @@ -17,10 +18,40 @@ const char* id; const char* url; uint32_t flags; }; +class CrashChannel final : public nsBaseChannel +{ +public: + explicit CrashChannel(nsIURI* aURI) + { + SetURI(aURI); + } + + nsresult OpenContentStream(bool async, nsIInputStream **stream, + nsIChannel** channel) override + { + nsAutoCString spec; + mURI->GetSpec(spec); + + if (spec.EqualsASCII("about:crashparent") && XRE_IsParentProcess()) { + MOZ_CRASH("Crash via about:crashparent"); + } + + if (spec.EqualsASCII("about:crashcontent") && XRE_IsContentProcess()) { + MOZ_CRASH("Crash via about:crashcontent"); + } + + NS_WARNING("Unhandled about:crash* URI or wrong process"); + return NS_ERROR_NOT_IMPLEMENTED; + } + +protected: + virtual ~CrashChannel() = default; +}; + /* Entries which do not have URI_SAFE_FOR_UNTRUSTED_CONTENT will run with chrome privileges. This is potentially dangerous. Please use URI_SAFE_FOR_UNTRUSTED_CONTENT in the third argument to each map item below unless your about: page really needs chrome privileges. Security review is @@ -135,16 +166,14 @@ nsIAboutModule::HIDE_FROM_ABOUTABOUT | nsIAboutModule::URI_CAN_LOAD_IN_CHILD }, { "crashparent", "about:blank", - nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | nsIAboutModule::HIDE_FROM_ABOUTABOUT }, { "crashcontent", "about:blank", - nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | nsIAboutModule::HIDE_FROM_ABOUTABOUT | nsIAboutModule::URI_CAN_LOAD_IN_CHILD | nsIAboutModule::URI_MUST_LOAD_IN_CHILD } }; @@ -164,16 +193,14 @@ NS_ENSURE_SUCCESS(rv, rv); nsCOMPtr ioService = do_GetIOService(&rv); NS_ENSURE_SUCCESS(rv, rv); - if (XRE_IsParentProcess() && path.EqualsASCII("crashparent")) { - MOZ_CRASH("Crash via about:crashparent"); - } - - if (XRE_IsContentProcess() && path.EqualsASCII("crashcontent")) { - MOZ_CRASH("Crash via about:crashcontent"); + if (path.EqualsASCII("crashparent") || path.EqualsASCII("crashcontent")) { + nsCOMPtr channel = new CrashChannel(aURI); + channel.forget(aResult); + return NS_OK; } for (int i = 0; i < kRedirTotal; i++) { if (!strcmp(path.get(), kRedirMap[i].id)) { nsCOMPtr tempChannel; diff --git a/docshell/test/mochitest/mochitest.ini b/docshell/test/mochitest/mochitest.ini --- a/docshell/test/mochitest/mochitest.ini +++ b/docshell/test/mochitest/mochitest.ini @@ -113,5 +113,6 @@ skip-if = toolkit == 'android' # bug 784321 support-files = file_framedhistoryframes.html [test_pushState_after_document_open.html] [test_windowedhistoryframes.html] [test_triggeringprincipal_location_seturi.html] +[test_bug1507702.html] diff --git a/docshell/test/mochitest/test_bug1507702.html b/docshell/test/mochitest/test_bug1507702.html new file mode 100644 --- /dev/null +++ b/docshell/test/mochitest/test_bug1507702.html @@ -0,0 +1,57 @@ + + + + + + Test for Bug 1507702 + + + + + +Mozilla Bug 1507702 + + + + + + +