Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 416534: Clean up cross-site xmlhttprequest security checks. With fixes to tests this time. r/sr=peterv

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@246616 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
jonas%sicking.cc
2008-02-27 03:45:32 +00:00
parent 425e84676b
commit 35f305467d
24 changed files with 342 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mozilla/caps/src/nsScriptSecurityManager.cpp
View File

@@ -98,6 +98,7 @@ nsIIOService *nsScriptSecurityManager::sIOService = nsnull;
nsIXPConnect *nsScriptSecurityManager::sXPConnect = nsnull;
nsIStringBundle *nsScriptSecurityManager::sStrBundle = nsnull;
JSRuntime *nsScriptSecurityManager::sRuntime = 0;
PRInt32 nsScriptSecurityManager::sFileURIOriginPolicy = FILEURI_SOP_SELF;
// Info we need about the JSClasses used by XPConnects wrapped
// natives, to avoid having to QI to nsIXPConnectWrappedNative all the
@@ -277,6 +278,7 @@ nsScriptSecurityManager::GetSafeJSContext()
return cx;
}
/* static */
PRBool
nsScriptSecurityManager::SecurityCompareURIs(nsIURI* aSourceURI,
nsIURI* aTargetURI)
@@ -378,7 +380,7 @@ nsScriptSecurityManager::SecurityCompareFileURIs(nsIURI* aSourceURI,
nsIURI* aTargetURI)
{
// in traditional unsafe behavior all files are the same origin
if (mFileURIOriginPolicy == FILEURI_SOP_TRADITIONAL)
if (sFileURIOriginPolicy == FILEURI_SOP_TRADITIONAL)
return PR_TRUE;
@@ -387,7 +389,7 @@ nsScriptSecurityManager::SecurityCompareFileURIs(nsIURI* aSourceURI,
PRBool filesAreEqual = PR_FALSE;
if (NS_FAILED( aSourceURI->Equals(aTargetURI, &filesAreEqual) ))
return PR_FALSE;
if (filesAreEqual || mFileURIOriginPolicy == FILEURI_SOP_SELF)
if (filesAreEqual || sFileURIOriginPolicy == FILEURI_SOP_SELF)
return filesAreEqual;
@@ -406,7 +408,7 @@ nsScriptSecurityManager::SecurityCompareFileURIs(nsIURI* aSourceURI,
// For policy ANYFILE we're done
if (mFileURIOriginPolicy == FILEURI_SOP_ANYFILE)
if (sFileURIOriginPolicy == FILEURI_SOP_ANYFILE)
return PR_TRUE;
@@ -425,7 +427,7 @@ nsScriptSecurityManager::SecurityCompareFileURIs(nsIURI* aSourceURI,
}
// check remaining policies
if (mFileURIOriginPolicy == FILEURI_SOP_SAMEDIR)
if (sFileURIOriginPolicy == FILEURI_SOP_SAMEDIR)
{
// file: URIs in the same directory have the same origin
PRBool sameParent = PR_FALSE;
@@ -436,7 +438,7 @@ nsScriptSecurityManager::SecurityCompareFileURIs(nsIURI* aSourceURI,
return sameParent;
}
if (mFileURIOriginPolicy == FILEURI_SOP_SUBDIR)
if (sFileURIOriginPolicy == FILEURI_SOP_SUBDIR)
{
// file: URIs can access files in the same or lower directories
PRBool isChild = PR_FALSE;
@@ -3259,11 +3261,10 @@ nsScriptSecurityManager::nsScriptSecurityManager(void)
mIsJavaScriptEnabled(PR_FALSE),
mIsMailJavaScriptEnabled(PR_FALSE),
mIsWritingPrefs(PR_FALSE),
mPolicyPrefsChanged(PR_TRUE),
mPolicyPrefsChanged(PR_TRUE)
#ifdef XPC_IDISPATCH_SUPPORT
mXPCDefaultGrantAll(PR_FALSE),
, mXPCDefaultGrantAll(PR_FALSE)
#endif
mFileURIOriginPolicy(FILEURI_SOP_SELF)
{
NS_ASSERTION(sizeof(long) == sizeof(void*), "long and void* have different lengths on this platform. This may cause a security failure.");
mPrincipals.Init(31);
@@ -3877,7 +3878,7 @@ nsScriptSecurityManager::ScriptSecurityPrefChanged()
PRInt32 policy;
rv = mSecurityPref->SecurityGetIntPref(sFileOriginPolicyPrefName, &policy);
mFileURIOriginPolicy = NS_SUCCEEDED(rv) ? policy : FILEURI_SOP_SELF;
sFileURIOriginPolicy = NS_SUCCEEDED(rv) ? policy : FILEURI_SOP_SELF;
#ifdef XPC_IDISPATCH_SUPPORT
rv = mSecurityPref->SecurityGetBoolPref(sXPCDefaultGrantAllName, &temp);