Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 416534: Clean up cross-site xmlhttprequest security checks. r/sr=peterv

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@246608 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
jonas%sicking.cc
2008-02-27 02:17:52 +00:00
parent a06bec25b2
commit 05e58d7ee2
23 changed files with 340 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
mozilla/caps/include/nsScriptSecurityManager.h
View File

@@ -395,6 +395,18 @@ public:
JSContext* GetSafeJSContext();
/**
* Utility method for comparing two URIs. For security purposes, two URIs
* are equivalent if their schemes, hosts, and ports (if any) match. This
* method returns true if aSubjectURI and aObjectURI have the same origin,
* false otherwise.
*/
static PRBool SecurityCompareURIs(nsIURI* aSourceURI, nsIURI* aTargetURI);
static nsresult
ReportError(JSContext* cx, const nsAString& messageTag,
nsIURI* aSource, nsIURI* aTarget);
private:
// GetScriptSecurityManager is the only call that can make one
@@ -420,10 +432,6 @@ private:
nsIPrincipal*
doGetSubjectPrincipal(nsresult* rv);
static nsresult
ReportError(JSContext* cx, const nsAString& messageTag,
nsIURI* aSource, nsIURI* aTarget);
nsresult
CheckPropertyAccessImpl(PRUint32 aAction,
nsAXPCNativeCallContext* aCallContext,
@@ -540,16 +548,9 @@ private:
nsISecurityPref* securityPref);
/**
* Utility method for comparing two URIs. For security purposes, two URIs
* are equivalent if their schemes, hosts, and ports (if any) match. This
* method returns true if aSubjectURI and aObjectURI have the same origin,
* false otherwise.
*/
PRBool SecurityCompareURIs(nsIURI* aSourceURI, nsIURI* aTargetURI);
/* encapsulate the file comparison rules */
PRBool SecurityCompareFileURIs(nsIURI* aSourceURI, nsIURI* aTargetURI);
static PRBool SecurityCompareFileURIs(nsIURI* aSourceURI,
nsIURI* aTargetURI);
#ifdef XPC_IDISPATCH_SUPPORT
// While this header is included outside of caps, this class isn't
@@ -590,7 +591,8 @@ private:
PRPackedBool mXPCDefaultGrantAll;
static const char sXPCDefaultGrantAllName[];
#endif
PRInt32 mFileURIOriginPolicy;
static PRInt32 sFileURIOriginPolicy;
static nsIIOService *sIOService;
static nsIXPConnect *sXPConnect;