Skip to content

Commit

Permalink
[embedlite-components] Set history item triggering principal to syste…
Browse files Browse the repository at this point in the history
…m. Fixes JB#54249 OMP#JOLLA-142

For security reasons the triggering principal of a link is used to
determine whether it can be loaded or not. For example local files can't
be opened by a null triggering principal.

Since history items restored after a restart were given a null
triggering principal, this was preventing local files being loaded from
the history (e.g. using the back/forward buttons) after a restart.

This change sets the triggering principal for restored history items to
the system principal. History items are loaded with the
INTERNAL_LOAD_FLAGS_INHERIT_PRINCIPAL flag unset. The principal for the
loaded file is therefore based on the file origin, rather than the
triggering principal, so the principal/security of the loaded item will
be unaffected.

More info on principals here:

https://developer.mozilla.org/en-US/docs/Mozilla/Gecko/Script_security
  • Loading branch information
llewelld committed May 19, 2021
1 parent d347c95 commit 010f93a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion jsscripts/embedhelper.js
Expand Up @@ -344,7 +344,7 @@ EmbedHelper.prototype = {
}
let historyEntry = Cc["@mozilla.org/browser/session-history-entry;1"].createInstance(Ci.nsISHEntry);
historyEntry.setURI(uri);
historyEntry.triggeringPrincipal = Services.scriptSecurityManager.createNullPrincipal({});
historyEntry.triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
shist.addEntry(historyEntry, true);
});
if (index < 0) {
Expand Down

0 comments on commit 010f93a

Please sign in to comment.