forked from mirrors/gecko-dev
166d68dc58
This doesn't seem a recent regression, the underlying issue is that we don't account for the Extensions content scripts (and user scripts) as other principals that may be able to intercept a drop event and then try to access the dataTransfer.files property before the webpage does. As the big inline comment inside DataTransferItemList::Files does explain, keeping a copy of the FileList when accessed from a webpage principal is necessary for spec compliance, while we don't cache it when it is being accessed by system principal code. (see https://searchfox.org/mozilla-central/rev/6cbe34b441f7c7c29cd1e5f0e19c7000142f1423/dom/events/DataTransferItemList.cpp#200-242) The changes in this patch are preventing us from caching the file list also when accessed by expanded principals (which are never going to be used for any web page, but they are used by both Extensions content scripts and Extensions user scripts), along with adding a new. regression test to prevent it from regressing without being noticed. Without this patch, when an extension content script or user script does intercept the drop event and access the dataTransfer.files property, we cache the FileList created for the ExpandedPrincipal associated to the Extension script and after that if the page try to access it we do return null because the webpage principal doesn't subsume the expanded principal (which is also why the issue isn't triggered if the webpage does access it first). In debug build we crash because we hit the assertion in DataTransferItemList::Files right before the earlier nullptr return we hit on release. Differential Revision: https://phabricator.services.mozilla.com/D113555 |
||
|---|---|---|
| .. | ||
| child | ||
| parent | ||
| schemas | ||
| test | ||
| .eslintrc.js | ||
| ext-browser.json | ||
| extension-linux-panel.css | ||
| extension-mac-panel.css | ||
| extension-mac.css | ||
| extension-win-panel.css | ||
| extension.css | ||
| extension.svg | ||
| ExtensionBrowsingData.jsm | ||
| ExtensionControlledPopup.jsm | ||
| ExtensionPopups.jsm | ||
| extensions-browser.manifest | ||
| jar.mn | ||
| moz.build | ||
