From 496757fd9c8df262737d5f653e9ae56dc204b236 Mon Sep 17 00:00:00 2001
From: piro <piro@599a83e7-65a4-db11-8015-0010dcdd6dc2>
Date: Sun, 13 Jun 2010 12:46:43 +0000
Subject: [PATCH] =?UTF-8?q?nsDragAndDrop.js=E3=81=8CTrunk=E3=81=A7?=
 =?UTF-8?q?=E4=BD=BF=E7=94=A8=E3=81=95=E3=82=8C=E3=81=AA=E3=81=8F=E3=81=AA?=
 =?UTF-8?q?=E3=81=A3=E3=81=A6transferUtils.retrieveURLFromData()=E3=81=8C?=
 =?UTF-8?q?=E4=BD=BF=E3=81=88=E3=81=AA=E3=81=8F=E3=81=AA=E3=81=A3=E3=81=9F?=
 =?UTF-8?q?=E3=81=AE=E3=81=A7=E3=80=81=E5=90=8C=E7=AD=89=E3=81=AE=E6=A9=9F?=
 =?UTF-8?q?=E8=83=BD=E3=82=92=E8=87=AA=E5=89=8D=E3=81=A7=E6=8C=81=E3=81=A4?=
 =?UTF-8?q?=E3=82=88=E3=81=86=E3=81=AB=E3=81=97=E3=81=9F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: http://www.cozmixng.org/repos/piro/treestyletab/trunk@6677 599a83e7-65a4-db11-8015-0010dcdd6dc2
---
 content/treestyletab/treestyletab.js | 47 +++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/content/treestyletab/treestyletab.js b/content/treestyletab/treestyletab.js
index 8e01fb0d..0bb07805 100644
--- a/content/treestyletab/treestyletab.js
+++ b/content/treestyletab/treestyletab.js
@@ -737,7 +737,8 @@ catch(e) {
 
 		sv.clearDropPosition();
 
-		var dropActionInfo = sv.getDropAction(aEvent, sv.getCurrentDragSession());
+		var session = sv.getCurrentDragSession();
+		var dropActionInfo = sv.getDropAction(aEvent, session);
 
 		var draggedTab;
 		if (dt.dropEffect != 'link') {
@@ -778,12 +779,13 @@ catch(e) {
 			aEvent.stopPropagation();
 
 			let url;
-			for (let i = 0; i < tabbar._supportedLinkDropTypes.length; i++) {
-				let dataType = tabbar._supportedLinkDropTypes[i];
+			let types = ['text/x-moz-url', 'text/uri-list', 'text/plain', 'application/x-moz-file'];
+			for (let i = 0; i < types.length; i++) {
+				let dataType = types[i];
 				let isURLList = dataType == 'text/uri-list';
 				let urlData = dt.mozGetDataAt(isURLList ? 'URL' : dataType , 0);
 				if (urlData) {
-					url = transferUtils.retrieveURLFromData(urlData, isURLList ? 'text/plain' : dataType);
+					url = this.retrieveURLFromData(urlData, isURLList ? 'text/plain' : dataType);
 					break;
 				}
 			}
@@ -791,7 +793,22 @@ catch(e) {
 			if (!url || !url.length || url.indexOf(' ', 0) != -1 || /^\s*(javascript|data):/.test(url))
 				return;
 
-			nsDragAndDrop.dragDropSecurityCheck(aEvent, sv.getCurrentDragSession(), url);
+			let (sourceDoc = session ? session.sourceDocument : null) {
+				if (sourceDoc &&
+					sourceDoc.documentURI.indexOf('chrome://') < 0) {
+					let sourceURI = sourceDoc.documentURI;
+					let nsIScriptSecurityManager = Components.interfaces.nsIScriptSecurityManager;
+					let secMan = Components.classes['@mozilla.org/scriptsecuritymanager;1']
+									.getService(nsIScriptSecurityManager);
+					try {
+						secMan.checkLoadURIStr(sourceDoc.documentURI, url, nsIScriptSecurityManager.STANDARD);
+					}
+					catch(e) {
+						aEvent.stopPropagation();
+						throw 'Drop of ' + url + ' denied.';
+					}
+				}
+			}
 
 			let bgLoad = this.getPref('browser.tabs.loadInBackground');
 			if (aEvent.shiftKey) bgLoad = !bgLoad;
@@ -825,6 +842,26 @@ catch(e) {
 			}
 		}
 	},
+	retrieveURLFromData: function TSTService_retrieveURLFromData(aData, aType)
+	{
+		switch (aType)
+		{
+			case 'text/unicode':
+			case 'text/plain':
+			case 'text/x-moz-text-internal':
+				return aData.replace(/^\s+|\s+$/g, '');
+
+			case 'text/x-moz-url':
+				return ((aData instanceof Components.interfaces.nsISupportsString) ? aData.toString() : aData)
+							.split('\n')[0];
+
+			case 'application/x-moz-file':
+				let fileHandler = this.IOService.getProtocolHandler('file')
+									.QueryInterface(Components.interfaces.nsIFileProtocolHandler);
+				return fileHandler.getURLSpecFromFile(aData);
+		}
+		return null;
+	},
  
 	onTabDragEnd : function TSTService_onTabDragEnd(aEvent) 
 	{