Bug 1767800 - Part 5: Factor out a method to check whether a URL to l…

…oad is trusted r=mccr8 Differential Revision: https://phabricator.services.mozilla.com/D145473
iaxat · May 6, 2022 · 180a271 · 180a271
1 parent f587179
commit 180a271
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -1249,6 +1249,11 @@ nsresult mozJSComponentLoader::ExtractExports(
   return NS_OK;
 }
 
+/* static */
+bool mozJSComponentLoader::IsTrustedScheme(nsIURI* aURI) {
+  return aURI->SchemeIs("resource") || aURI->SchemeIs("chrome");
+}
+
 nsresult mozJSComponentLoader::Import(JSContext* aCx,
                                       const nsACString& aLocation,
                                       JS::MutableHandleObject aModuleGlobal,
@@ -1281,8 +1286,7 @@ nsresult mozJSComponentLoader::Import(JSContext* aCx,
     MOZ_TRY(info.EnsureResolvedURI());
 
     // Reject imports from untrusted sources.
-    if ((!info.URI()->SchemeIs("resource")) &&
-        (!info.URI()->SchemeIs("chrome"))) {
+    if (!IsTrustedScheme(info.URI())) {
       return NS_ERROR_DOM_SECURITY_ERR;
     }
 

diff --git a/js/xpconnect/loader/mozJSComponentLoader.h b/js/xpconnect/loader/mozJSComponentLoader.h
@@ -72,6 +72,8 @@ class mozJSComponentLoader final : public nsIMemoryReporter {
   nsresult IsModuleLoaded(const nsACString& aResourceURI, bool* aRetval);
   bool IsLoaderGlobal(JSObject* aObj) { return mLoaderGlobal == aObj; }
 
+  static bool IsTrustedScheme(nsIURI* aURI);
+
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf);
 
  protected: