Allow disabling JavaScript in basic viewer (#3089)

And:
- Prevent JavaScript inside notes from executing in reports
- Update calls to openInViewer() to pass an options object

chrome/content/zotero/preferences/preferences_cite.jsx

@@ -140,7 +140,8 @@ Zotero_Preferences.Cite = {
 	
 	
 	openStylesPage: function () {
-		Zotero.openInViewer("https://www.zotero.org/styles/", function (doc) {
+		Zotero.openInViewer("https://www.zotero.org/styles/", {
+			onLoad(doc) {
 				// Hide header, intro paragraph, Link, and Source
 				//
 				// (The first two aren't sent to the client normally, but hide anyway in case they are.)
@@ -152,6 +153,7 @@ Zotero_Preferences.Cite = {
 					+ 'a { color: rgb(0, 0, 238) !important; text-decoration: underline; }'
 					+ 'a:active { color: rgb(238, 0, 0) !important; }';
 				doc.getElementsByTagName('head')[0].appendChild(style);
+			}
 		});
 	},
 	

chrome/content/zotero/preferences/preferences_cite.xhtml

@@ -61,10 +61,10 @@
 			<hbox>
 				<button id="openCSLEdit"
 					label="&zotero.preferences.styleEditor;"
-					oncommand="Zotero.openInViewer('chrome://zotero/content/tools/csledit.xhtml', true)"/>
+					oncommand="Zotero.openInViewer('chrome://zotero/content/tools/csledit.xhtml')"/>
 				<button id="openCSLPreview"
 					label="&zotero.preferences.stylePreview;"
-					oncommand="Zotero.openInViewer('chrome://zotero/content/tools/cslpreview.xhtml', true)"/>
+					oncommand="Zotero.openInViewer('chrome://zotero/content/tools/cslpreview.xhtml')"/>
 			</hbox>
 		</groupbox>
 	</vbox>

chrome/content/zotero/reportInterface.js

@@ -54,7 +54,7 @@ var Zotero_Report_Interface = new function() {
 		
 		url += '/items' + queryString;
 		
-		Zotero.openInViewer(url);
+		Zotero.openInViewer(url, { allowJavaScript: false });
 	}
 	
 	
@@ -71,6 +71,6 @@ var Zotero_Report_Interface = new function() {
 		
 		var url = 'zotero://report/' + Zotero.API.getLibraryPrefix(libraryID) + '/items'
 			+ '?itemKey=' + items.map(item => item.key).join(',');
-		Zotero.openInViewer(url);
+		Zotero.openInViewer(url, { allowJavaScript: false });
 	}
 }

chrome/content/zotero/standalone/basicViewer.js

@@ -27,6 +27,8 @@
 	"resource://gre/modules/E10SUtils.jsm"
 );*/
 
+const SANDBOXED_SCRIPTS = 0x80;
+
 var browser;
 
 window.addEventListener("load", /*async */function () {
@@ -51,9 +53,10 @@ window.addEventListener("load", /*async */function () {
 	);*/
 	//browser.docShellIsActive = false;
 
-	// Load URI passed in as nsISupports .data via openWindow()
+	// Get URI and options passed in via openWindow()
-	window.viewerOriginalURI = window.arguments[0];
+	let { uri, options } = window.arguments[0].wrappedJSObject;
-	loadURI(window.arguments[0]);
+	window.viewerOriginalURI = uri;
+	loadURI(uri, options);
 }, false);
 
 window.addEventListener("keypress", function (event) {
@@ -73,7 +76,15 @@ window.addEventListener("click", function (event) {
 	}
 });
 
-function loadURI(uri) {
+function loadURI(uri, options = {}) {
+	// browser.browsingContext.allowJavascript (sic) would seem to do what we want here,
+	// but it has no effect. So we use sandboxFlags instead:
+	if (options.allowJavaScript !== false) {
+		browser.browsingContext.sandboxFlags &= ~SANDBOXED_SCRIPTS;
+	}
+	else {
+		browser.browsingContext.sandboxFlags |= SANDBOXED_SCRIPTS;
+	}
 	browser.loadURI(
 		uri,
 		{

chrome/content/zotero/standalone/standalone.js

@@ -850,7 +850,8 @@ ZoteroStandalone.DebugOutput = {
 	
 	
 	view: function () {
-		Zotero.openInViewer("chrome://zotero/content/debugViewer.html", function (doc) {
+		Zotero.openInViewer("chrome://zotero/content/debugViewer.html", {
+			onLoad(doc) {
 				var submitted = false;
 				doc.querySelector('#submit-button').addEventListener('click', function (event) {
 					submitted = true;
@@ -865,6 +866,7 @@ ZoteroStandalone.DebugOutput = {
 						Zotero.Debug.clear();
 					}
 				});
+			}
 		});
 	},
 	

chrome/content/zotero/xpcom/zotero.js

@@ -1087,9 +1087,16 @@ Services.scriptloader.loadSubScript("resource://zotero/polyfill.js");
 	 * Opens a URL in the basic viewer, and optionally run a callback on load
 	 *
 	 * @param {String} uri
-	 * @param {Function} [onLoad] - Function to run once URI is loaded; passed the loaded document
+	 * @param {Object} [options]
+	 * @param {Function} [options.onLoad] - Function to run once URI is loaded; passed the loaded document
+	 * @param {Boolean} [options.allowJavaScript] - Set to false to disable JavaScript
 	 */
-	this.openInViewer = function (uri, onLoad) {
+	this.openInViewer = function (uri, options) {
+		if (options && !options.onLoad && typeof options === 'function') {
+			Zotero.debug("Zotero.openInViewer() now takes an 'options' object for its second parameter -- update your code");
+			options = { onLoad: options };
+		}
+
 		var viewerWins = Services.wm.getEnumerator("zotero:basicViewer");
 		for (let existingWin of viewerWins) {
 			if (existingWin.viewerOriginalURI === uri) {
@@ -1099,12 +1106,17 @@ Services.scriptloader.loadSubScript("resource://zotero/polyfill.js");
 		}
 		let ww = Components.classes['@mozilla.org/embedcomp/window-watcher;1']
 			.getService(Components.interfaces.nsIWindowWatcher);
-		let arg = Components.classes["@mozilla.org/supports-string;1"]
+		let arg = {
-			.createInstance(Components.interfaces.nsISupportsString);
+			uri,
-		arg.data = uri;
+			options: {
+				...options,
+				onLoad: undefined
+			}
+		};
+		arg.wrappedJSObject = arg;
 		let win = ww.openWindow(null, "chrome://zotero/content/standalone/basicViewer.xhtml",
 			null, "chrome,dialog=yes,resizable,centerscreen,menubar,scrollbars", arg);
-		if (onLoad) {
+		if (options?.onLoad) {
 			let browser;
 			let func = function () {
 				win.removeEventListener("load", func);
@@ -1117,7 +1129,7 @@ Services.scriptloader.loadSubScript("resource://zotero/polyfill.js");
 			};
 			let innerFunc = function () {
 				browser.removeEventListener("pageshow", innerFunc);
-				onLoad(browser.contentDocument);
+				options.onLoad(browser.contentDocument);
 			};
 			win.addEventListener("load", func);
 		}

chrome/content/zotero/zoteroPane.xhtml

@@ -537,7 +537,7 @@
 									label="&installConnector.label;"
 									oncommand="ZoteroStandalone.openHelp('connectors');"/>
 							<menuitem id="menu_addons" label="&addons.label;"
-									oncommand="Zotero.openInViewer('chrome://mozapps/content/extensions/aboutaddons.html', ZoteroStandalone.updateAddonsPane)"/>
+									oncommand="Zotero.openInViewer('chrome://mozapps/content/extensions/aboutaddons.html', { onLoad: ZoteroStandalone.updateAddonsPane })"/>
 							<menu id="developer-menu"
 									label="&developer.label;">
 								<menupopup>