From 2734d7a2c8dac5ac557cbd67a6a82ced09818edd Mon Sep 17 00:00:00 2001 From: "gavin%gavinsharp.com" Date: Tue, 10 Oct 2006 13:46:21 +0000 Subject: [PATCH] =?UTF-8?q?Bug=20350558:=20work=20around=20the=20fact=20th?= =?UTF-8?q?at=20arrays=20from=20a=20sandbox=20are=20only=20instanceof=20sa?= =?UTF-8?q?ndbox.Array=20(and=20not=20instanceof=20Array),=20patch=20by=20?= =?UTF-8?q?Simon=20B=C3=BCnzli=20,=20r=3Dmano?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit git-svn-id: svn://10.0.0.236/trunk@213417 18797224-902f-48f8-a5cc-f745e15eee43 --- .../components/sessionstore/src/nsSessionStore.js | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/mozilla/browser/components/sessionstore/src/nsSessionStore.js b/mozilla/browser/components/sessionstore/src/nsSessionStore.js index 7432eb6c5e0..a7678b7d0c8 100644 --- a/mozilla/browser/components/sessionstore/src/nsSessionStore.js +++ b/mozilla/browser/components/sessionstore/src/nsSessionStore.js @@ -124,6 +124,9 @@ const CAPABILITIES = [ "Subframes", "Plugins", "Javascript", "MetaRedirects", "Images" ]; +// sandbox to evaluate JavaScript code from non-trustable sources +var EVAL_SANDBOX = new Components.utils.Sandbox("about:blank"); + function debug(aMsg) { aMsg = ("SessionStore: " + aMsg).replace(/\S{80}/g, "$&\n"); Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIConsoleService) @@ -1218,8 +1221,7 @@ SessionStoreService.prototype = { } } if (winData._closedTabs && (root._firstTabs || aOverwriteTabs)) { - //XXXzeniko remove the slice call as soon as _closedTabs instanceof Array - this._windows[aWindow.__SSi]._closedTabs = winData._closedTabs.slice(); + this._windows[aWindow.__SSi]._closedTabs = winData._closedTabs; } this.restoreHistoryPrecursor(aWindow, winData.tabs, (aOverwriteTabs ? @@ -1870,8 +1872,7 @@ SessionStoreService.prototype = { * safe eval'ing */ _safeEval: function sss_safeEval(aStr) { - var s = new Components.utils.Sandbox("about:blank"); - return Components.utils.evalInSandbox(aStr, s); + return Components.utils.evalInSandbox(aStr, EVAL_SANDBOX); }, /** @@ -1913,7 +1914,7 @@ SessionStoreService.prototype = { else if (aObj == null) { parts.push("null"); } - else if (aObj instanceof Array) { + else if (aObj instanceof Array || aObj instanceof EVAL_SANDBOX.Array) { parts.push("["); for (var i = 0; i < aObj.length; i++) { jsonIfy(aObj[i]);