From: Ehsan Akhgari diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp --- a/uriloader/exthandler/nsExternalHelperAppService.cpp +++ b/uriloader/exthandler/nsExternalHelperAppService.cpp @@ -1114,16 +1114,29 @@ nsExternalAppHandler::nsExternalAppHandl // make sure the extention includes the '.' if (!aTempFileExtension.IsEmpty() && aTempFileExtension.First() != '.') mTempFileExtension = PRUnichar('.'); AppendUTF8toUTF16(aTempFileExtension, mTempFileExtension); // replace platform specific path separator and illegal characters to avoid any confusion mSuggestedFileName.ReplaceChar(FILE_PATH_SEPARATOR FILE_ILLEGAL_CHARACTERS, '_'); mTempFileExtension.ReplaceChar(FILE_PATH_SEPARATOR FILE_ILLEGAL_CHARACTERS, '_'); + + // Remove unsafe bidi characters which might have spoofing implications (bug 511521). + const PRUnichar unsafeBidiCharacters[] = { + PRUnichar(0x202a), // Left-to-Right Embedding + PRUnichar(0x202b), // Right-to-Left Embedding + PRUnichar(0x202c), // Pop Directional Formatting + PRUnichar(0x202d), // Left-to-Right Override + PRUnichar(0x202e) // Right-to-Left Override + }; + for (int i = 0; i < NS_ARRAY_LENGTH(unsafeBidiCharacters); ++i) { + mSuggestedFileName.ReplaceChar(unsafeBidiCharacters[i], '_'); + mTempFileExtension.ReplaceChar(unsafeBidiCharacters[i], '_'); + } // Make sure extension is correct. EnsureSuggestedFileName(); gExtProtSvc->AddRef(); } nsExternalAppHandler::~nsExternalAppHandler() diff --git a/uriloader/exthandler/tests/mochitest/Makefile.in b/uriloader/exthandler/tests/mochitest/Makefile.in --- a/uriloader/exthandler/tests/mochitest/Makefile.in +++ b/uriloader/exthandler/tests/mochitest/Makefile.in @@ -41,14 +41,16 @@ srcdir = @srcdir@ VPATH = @srcdir@ relativesrcdir = uriloader/exthandler/tests/mochitest include $(DEPTH)/config/autoconf.mk include $(topsrcdir)/config/rules.mk _TEST_FILES = \ test_handlerApps.xhtml \ + test_unsafeBidiChars.xhtml \ handlerApps.js \ handlerApp.xhtml \ + unsafeBidiFileName.sjs \ $(NULL) libs:: $(_TEST_FILES) $(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir) diff --git a/uriloader/exthandler/tests/mochitest/test_unsafeBidiChars.xhtml b/uriloader/exthandler/tests/mochitest/test_unsafeBidiChars.xhtml new file mode 100644 --- /dev/null +++ b/uriloader/exthandler/tests/mochitest/test_unsafeBidiChars.xhtml @@ -0,0 +1,135 @@ + + + Test for Handling of unsafe bidi chars + + + + + +

+ + + + + diff --git a/uriloader/exthandler/tests/mochitest/unsafeBidiFileName.sjs b/uriloader/exthandler/tests/mochitest/unsafeBidiFileName.sjs new file mode 100644 --- /dev/null +++ b/uriloader/exthandler/tests/mochitest/unsafeBidiFileName.sjs @@ -0,0 +1,47 @@ +/* ***** BEGIN LICENSE BLOCK ***** + * Version: MPL 1.1/GPL 2.0/LGPL 2.1 + * + * The contents of this file are subject to the Mozilla Public License Version + * 1.1 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * http://www.mozilla.org/MPL/ + * + * Software distributed under the License is distributed on an "AS IS" basis, + * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License + * for the specific language governing rights and limitations under the + * License. + * + * The Original Code is Handler Apps Tests. + * + * The Initial Developer of the Original Code is + * Ehsan Akhgari. + * Portions created by the Initial Developer are Copyright (C) 2009 + * the Initial Developer. All Rights Reserved. + * + * Contributor(s): + * Ehsan Akhgari (Original Author) + * + * Alternatively, the contents of this file may be used under the terms of + * either of the GNU General Public License Version 2 or later (the "GPL"), + * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), + * in which case the provisions of the GPL or the LGPL are applicable instead + * of those above. If you wish to allow use of your version of this file only + * under the terms of either the GPL or the LGPL, and not to allow others to + * use your version of this file under the terms of the MPL, indicate your + * decision by deleting the provisions above and replace them with the notice + * and other provisions required by the GPL or the LGPL. If you do not delete + * the provisions above, a recipient may use your version of this file under + * the terms of any one of the MPL, the GPL or the LGPL. + * + * ***** END LICENSE BLOCK ***** */ + +function handleRequest(request, response) { + response.setStatusLine(request.httpVersion, 200, "OK"); + + if (!request.queryString.match(/^name=/)) + return; + var name = decodeURIComponent(request.queryString.substring(5)); + + response.setHeader("Content-Type", "application/octet-stream; name=\"" + name + "\""); + response.setHeader("Content-Disposition", "inline; filename=\"" + name + "\""); +}