You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.
It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.
I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.
Issue by JordanMilne
Monday Nov 18, 2013 at 20:49 GMT
Originally opened as RequestPolicy/requestpolicy#409
It's possible to bypass the whitelist entirely by referencing a resource using the jar URI scheme:
Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.
It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.
I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.
JordanMilne included the following code: https://github.com/RequestPolicy/requestpolicy/pull/409/commits
The text was updated successfully, but these errors were encountered: