[Pkg-mozext-commits] [greasemonkey] 03/15: Do not install scripts from "script like" pages.

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository greasemonkey.

commit d5773cec71dc37665ee7d5b5c1b86f3d964bebcf
Author: Anthony Lieuallen <arantius at gmail.com>
Date:   Thu Jul 31 10:29:30 2014 -0400

    Do not install scripts from "script like" pages.
    
    If the origin URL for a script looks like a script, then:
    
    1) The origin URL was a text/html exception which we loaded rather than installing, so:
    2) This new URL probably is some kind of exception as well.
    
    The case in question now is the online editor in GitHub which satisfies this case.
    
    Fixes #1875
---
 components/greasemonkey.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/components/greasemonkey.js b/components/greasemonkey.js
index e9623bc..8429bdc 100644
--- a/components/greasemonkey.js
+++ b/components/greasemonkey.js
@@ -24,6 +24,7 @@ var gMaxJSVersion = "ECMAv5";
 
 var gMenuCommands = [];
 var gStartupHasRun = false;
+var gScriptEndingRegexp = new RegExp('\\.user\\.js$');
 
 var gFileProtocolHandler = Components
     .classes["@mozilla.org/network/protocol;1?name=file"]
@@ -355,9 +356,14 @@ service.prototype.shouldLoad = function(ct, cl, org, ctx, mt, ext) {
     return ret;
   }
 
+  // Do not install scripts when the origin URL "is a script".  See #1875
+  if (org.spec.match(gScriptEndingRegexp)) {
+    return ret;
+  }
+
   if ((ct == Ci.nsIContentPolicy.TYPE_DOCUMENT
        || ct == Ci.nsIContentPolicy.TYPE_SUBDOCUMENT)
-      && cl.spec.match(/\.user\.js$/)
+      && cl.spec.match(gScriptEndingRegexp)
   ) {
     if (!this._ignoreNextScript && !isTempScript(cl)) {
       GM_util.showInstallDialog(cl.spec, ctx, this);

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-mozext/greasemonkey.git