tor-browser

commit c3ac8a3998e6fb6644fcdb2c65f23a584c11674f
parent 997f74380e12abbd697e6f85c06c0cb5cb3b3a38
Author: Kagami Sascha Rosylight <krosylight@proton.me>
Date:   Tue,  7 Oct 2025 16:49:37 +0000

Bug 1980904 - Deny notification requests for all cross origins r=asuth

Including same sites.

Differential Revision: https://phabricator.services.mozilla.com/D267012

Diffstat:
M
dom/notification/Notification.cpp
 | 
3
+++

1 file changed, 3 insertions(+), 0 deletions(-)
diff --git a/dom/notification/Notification.cpp b/dom/notification/Notification.cpp
@@ -134,6 +134,9 @@ NotificationPermissionRequest::Run() {
                  PermissionCheckPurpose::PermissionRequest,
                  mWindow->GetExtantDoc())) {
     mPermission = NotificationPermission::Denied;
+  } else if (!StaticPrefs::dom_webnotifications_allowcrossoriginiframe() &&
+             !mPrincipal->Subsumes(mTopLevelPrincipal)) {
+    mPermission = NotificationPermission::Denied;
   }
 
   // We can't call ShowPrompt() directly here since our logic for determining