Allow certain types of data URLs and add test case

mozilla-mobile · Mar 31, 2020 · 238d51b · 238d51b
1 parent dba6453
commit 238d51b
Show file tree

Hide file tree

Showing 3 changed files with 56 additions and 1 deletion.
diff --git a/Client/Frontend/Browser/BrowserViewController/BrowserViewController+WebViewDelegates.swift b/Client/Frontend/Browser/BrowserViewController/BrowserViewController+WebViewDelegates.swift
@@ -431,7 +431,27 @@ extension BrowserViewController: WKNavigationDelegate {
             return
         }
 
+        // https://blog.mozilla.org/security/2017/11/27/blocking-top-level-navigations-data-urls-firefox-59/
         if url.scheme == "data" {
+            let url = url.absoluteString
+            // Allow certain image types
+            if url.hasPrefix("data:image/") && !url.hasPrefix("data:image/svg+xml") {
+                decisionHandler(.allow)
+                return
+            }
+
+            // Allow certain application types
+            if url.hasPrefix("data:application/pdf") || url.hasPrefix("data:application/json") {
+                decisionHandler(.allow)
+                return
+            }
+
+            // Allow plan text types
+            if url.hasPrefix("data:;") || url.hasPrefix("data:,") || url.hasPrefix("data:text/plain") {
+                decisionHandler(.allow)
+                return
+            }
+
             decisionHandler(.cancel)
             return
         }

diff --git a/UITests/SecurityTests.swift b/UITests/SecurityTests.swift
@@ -120,9 +120,35 @@ class SecurityTests: KIFTestCase {
         XCTAssertEqual(webView.url!.absoluteString, url)
     }
 
+      func closeAllTabs() {
+        let closeButtonMatchers: [GREYMatcher] =
+            [grey_accessibilityID("TabTrayController.deleteButton.closeAll"),
+            grey_kindOfClass(NSClassFromString("_UIAlertControllerActionView")!)]
+
+          EarlGrey.selectElement(with: grey_accessibilityID("TabTrayController.removeTabsButton")).perform(grey_tap())
+          EarlGrey.selectElement(with: grey_allOf(closeButtonMatchers)).perform(grey_tap())
+      }
+
+    func testDataURL() {
+        // Check data urls that are valid
+        ["data-url-ok-1", "data-url-ok-2"].forEach { buttonName in
+            tester().tapWebViewElementWithAccessibilityLabel(buttonName)
+            tester().wait(forTimeInterval: 1)
+            let webView = tester().waitForView(withAccessibilityLabel: "Web content") as! WKWebView
+            XCTAssert(webView.url!.absoluteString.hasPrefix("data:")) // indicates page loaded ok
+            BrowserUtils.resetToAboutHome()
+            beforeEach()
+        }
+
+        // Check data url that is no allowed
+        tester().tapWebViewElementWithAccessibilityLabel("data-url-html-bad")
+        tester().wait(forTimeInterval: 1)
+        let webView = tester().waitForView(withAccessibilityLabel: "Web content") as! WKWebView
+        XCTAssert(webView.url == nil) // indicates page load was blocked
+    }
+
     override func tearDown() {
         BrowserUtils.resetToAboutHome()
-        BrowserUtils.clearPrivateData()
         super.tearDown()
     }
 }
diff --git a/UITests/localhostLoad.html b/UITests/localhostLoad.html
@@ -19,5 +19,14 @@
   <button onclick="window.open(errorURL)">Error exploit</button>
   <button onclick="newTabExploit()">New tab exploit</button>
   <button onclick="window.open('http://1.2.3.4:1234')">URL spoof</button>
+
+  <p>
+      Tries to open a window with the word test. Both should be ok to do.<br>
+      <button onclick="window.open('data:;,test')">data-url-ok-1</button><br>
+      <button onclick="window.open('data:text/plain,test')">data-url-ok-2</button>
+      <br>
+      Tries to open a html data URL, this is a no-no.<br>
+      <button onclick="window.open('data:text/html;base64,VGhpcyBpcyBhIHRlc3QK')">data-url-html-bad</button>
+  </p>
 </body>
 </html>