Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing bug 504862. Sanitize modal dialog argument handling. r=mrbkap@gmail.com, sr=bzbarsky@mit.edu, a=dveditz@mozilla.com

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@258988 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
jst%mozilla.org
2009-11-13 23:40:57 +00:00
parent 893fb00eb3
commit 370e4495ec
9 changed files with 268 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
mozilla/dom/public/base/nsPIDOMWindow.h
View File

@@ -74,6 +74,7 @@ class nsPresContext;
struct nsTimeout;
class nsScriptObjectHolder;
class nsXBLPrototypeHandler;
class nsIArray;
#define NS_PIDOMWINDOW_IID \
{ 0x909852b5, 0xb9e6, 0x4d94, \
@@ -432,9 +433,37 @@ protected:
nsPIDOMWindow *mOuterWindow;
};
NS_DEFINE_STATIC_IID_ACCESSOR(nsPIDOMWindow, NS_PIDOMWINDOW_IID)
#define NS_PIDOMWINDOW_1_9_0_IID \
{ 0x76cdc610, 0x324f, 0x4d5c, \
{ 0x8d, 0x3b, 0x6f, 0xee, 0x1d, 0x88, 0xba, 0xfc } }
class nsPIDOMWindow_1_9_0 : public nsPIDOMWindow
{
public:
NS_DECLARE_STATIC_IID_ACCESSOR(NS_PIDOMWINDOW_1_9_0_IID)
/**
* Set a arguments for this window. This will be set on the window
* right away (if there's an existing document) and it will also be
* installed on the window when the next document is loaded. Each
* language impl is responsible for converting to an array of args
* as appropriate for that language.
*/
virtual nsresult SetArguments(nsIArray *aArguments, nsIPrincipal *aOrigin) = 0;
protected:
nsPIDOMWindow_1_9_0(nsPIDOMWindow *aOuterWindow)
: nsPIDOMWindow(aOuterWindow)
{
}
};
NS_DEFINE_STATIC_IID_ACCESSOR(nsPIDOMWindow_1_9_0, NS_PIDOMWINDOW_1_9_0_IID)
#ifdef _IMPL_NS_LAYOUT
PopupControlState
PushPopupControlState(PopupControlState aState, PRBool aForce);

21
mozilla/dom/src/base/nsDOMClassInfo.cpp
View File

@@ -1270,6 +1270,7 @@ jsval nsDOMClassInfo::sToolbar_id = JSVAL_VOID;
jsval nsDOMClassInfo::sLocationbar_id = JSVAL_VOID;
jsval nsDOMClassInfo::sPersonalbar_id = JSVAL_VOID;
jsval nsDOMClassInfo::sStatusbar_id = JSVAL_VOID;
jsval nsDOMClassInfo::sDialogArguments_id = JSVAL_VOID;
jsval nsDOMClassInfo::sDirectories_id = JSVAL_VOID;
jsval nsDOMClassInfo::sControllers_id = JSVAL_VOID;
jsval nsDOMClassInfo::sLength_id = JSVAL_VOID;
@@ -1462,6 +1463,7 @@ nsDOMClassInfo::DefineStaticJSVals(JSContext *cx)
SET_JSVAL_TO_STRING(sLocationbar_id, cx, "locationbar");
SET_JSVAL_TO_STRING(sPersonalbar_id, cx, "personalbar");
SET_JSVAL_TO_STRING(sStatusbar_id, cx, "statusbar");
SET_JSVAL_TO_STRING(sDialogArguments_id, cx, "dialogArguments");
SET_JSVAL_TO_STRING(sDirectories_id, cx, "directories");
SET_JSVAL_TO_STRING(sControllers_id, cx, "controllers");
SET_JSVAL_TO_STRING(sLength_id, cx, "length");
@@ -4023,6 +4025,7 @@ nsDOMClassInfo::ShutDown()
sLocationbar_id = JSVAL_VOID;
sPersonalbar_id = JSVAL_VOID;
sStatusbar_id = JSVAL_VOID;
sDialogArguments_id = JSVAL_VOID;
sDirectories_id = JSVAL_VOID;
sControllers_id = JSVAL_VOID;
sLength_id = JSVAL_VOID;
@@ -6217,6 +6220,24 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
}
}
#endif
if (id == sDialogArguments_id &&
mData == &sClassInfoData[eDOMClassInfo_ModalContentWindow_id]) {
nsCOMPtr<nsIArray> args;
((nsGlobalModalWindow *)win)->GetDialogArguments(getter_AddRefs(args));
nsIScriptContext *script_cx = win->GetContext();
if (script_cx) {
// Make nsJSContext::SetProperty()'s magic argument array
// handling happen.
rv = script_cx->SetProperty(obj, "dialogArguments", args);
NS_ENSURE_SUCCESS(rv, rv);
*objp = obj;
}
return NS_OK;
}
}
JSObject *oldobj = *objp;

1
mozilla/dom/src/base/nsDOMClassInfo.h
View File

@@ -252,6 +252,7 @@ protected:
static jsval sLocationbar_id;
static jsval sPersonalbar_id;
static jsval sStatusbar_id;
static jsval sDialogArguments_id;
static jsval sDirectories_id;
static jsval sControllers_id;
static jsval sLength_id;

163
mozilla/dom/src/base/nsGlobalWindow.cpp
View File

@@ -591,7 +591,7 @@ nsTimeout::~nsTimeout()
//*****************************************************************************
nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
: nsPIDOMWindow(aOuterWindow),
: nsPIDOMWindow_1_9_0(aOuterWindow),
mIsFrozen(PR_FALSE),
mDidInitJavaProperties(PR_FALSE),
mFullScreen(PR_FALSE),
@@ -829,6 +829,7 @@ nsGlobalWindow::CleanUp()
}
mArguments = nsnull;
mArgumentsLast = nsnull;
mArgumentsOrigin = nsnull;
CleanupCachedXBLHandlers(this);
@@ -947,6 +948,7 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGlobalWindow)
NS_INTERFACE_MAP_ENTRY(nsIDOM3EventTarget)
NS_INTERFACE_MAP_ENTRY(nsIDOMNSEventTarget)
NS_INTERFACE_MAP_ENTRY(nsPIDOMWindow)
NS_INTERFACE_MAP_ENTRY(nsPIDOMWindow_1_9_0)
NS_INTERFACE_MAP_ENTRY(nsIDOMViewCSS)
NS_INTERFACE_MAP_ENTRY(nsIDOMAbstractView)
NS_INTERFACE_MAP_ENTRY(nsIDOMStorageWindow)
@@ -1126,7 +1128,7 @@ nsGlobalWindow::SetScriptContext(PRUint32 lang_id, nsIScriptContext *aScriptCont
NS_ASSERTION(script_glob, "GetNativeGlobal returned NULL!");
}
// for now, keep mContext real.
if (lang_id==nsIProgrammingLanguage::JAVASCRIPT) {
if (lang_id == nsIProgrammingLanguage::JAVASCRIPT) {
mContext = aScriptContext;
mJSObject = (JSObject *)script_glob;
}
@@ -1970,8 +1972,12 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
}
if (mArguments) {
newInnerWindow->SetNewArguments(mArguments);
newInnerWindow->DefineArgumentsProperty(mArguments);
newInnerWindow->mArguments = mArguments;
newInnerWindow->mArgumentsOrigin = mArgumentsOrigin;
mArguments = nsnull;
mArgumentsOrigin = nsnull;
}
// Give the new inner window our chrome event handler (since it
@@ -2074,9 +2080,10 @@ nsGlobalWindow::SetDocShell(nsIDocShell* aDocShell)
if (mArguments) {
// We got no new document after someone called
// SetNewArguments(), drop our reference to the arguments.
// SetArguments(), drop our reference to the arguments.
mArguments = nsnull;
// xxxmarkh - should we also drop mArgumentsLast?
mArgumentsLast = nsnull;
mArgumentsOrigin = nsnull;
}
PRUint32 st_ndx;
@@ -2382,39 +2389,66 @@ nsGlobalWindow::SetScriptsEnabled(PRBool aEnabled, PRBool aFireTimeouts)
nsresult
nsGlobalWindow::SetNewArguments(nsIArray *aArguments)
{
FORWARD_TO_OUTER(SetNewArguments, (aArguments), NS_ERROR_NOT_INITIALIZED);
return SetArguments(aArguments, nsnull);
}
JSContext *cx;
NS_ENSURE_TRUE(aArguments && mContext &&
(cx = (JSContext *)mContext->GetNativeContext()),
NS_ERROR_NOT_INITIALIZED);
// Note that currentInner may be non-null if someone's doing a
// window.open with an existing window name.
nsGlobalWindow *currentInner = GetCurrentInnerWindowInternal();
nsresult rv;
if (currentInner) {
PRUint32 langID;
NS_STID_FOR_ID(langID) {
void *glob = currentInner->GetScriptGlobal(langID);
nsIScriptContext *ctx = GetScriptContext(langID);
if (glob && ctx) {
if (mIsModalContentWindow) {
rv = ctx->SetProperty(glob, "dialogArguments", aArguments);
} else {
rv = ctx->SetProperty(glob, "arguments", aArguments);
}
NS_ENSURE_SUCCESS(rv, rv);
}
}
}
nsresult
nsGlobalWindow::SetArguments(nsIArray *aArguments, nsIPrincipal *aOrigin)
{
FORWARD_TO_OUTER(SetArguments, (aArguments, aOrigin),
NS_ERROR_NOT_INITIALIZED);
// Hold on to the arguments so that we can re-set them once the next
// document is loaded.
mArguments = aArguments;
mArgumentsLast = aArguments;
mArgumentsOrigin = aOrigin;
nsGlobalWindow *currentInner = GetCurrentInnerWindowInternal();
if (!mIsModalContentWindow) {
mArgumentsLast = aArguments;
} else if (currentInner) {
// SetArguments() is being called on a modal content window that
// already has an inner window. This can happen when loading
// javascript: URIs as modal content dialogs. In this case, we'll
// set up the dialog window, both inner and outer, before we call
// SetArguments() on the window, so to deal with that, make sure
// here that the arguments are propagated to the inner window.
currentInner->mArguments = aArguments;
currentInner->mArgumentsOrigin = aOrigin;
}
return currentInner ?
currentInner->DefineArgumentsProperty(aArguments) : NS_OK;
}
nsresult
nsGlobalWindow::DefineArgumentsProperty(nsIArray *aArguments)
{
JSContext *cx;
nsIScriptContext *ctx = GetOuterWindowInternal()->mContext;
NS_ENSURE_TRUE(aArguments && ctx &&
(cx = (JSContext *)ctx->GetNativeContext()),
NS_ERROR_NOT_INITIALIZED);
if (mIsModalContentWindow) {
// Modal content windows don't have an "arguments" property, they
// have a "dialogArguments" property which is handled
// separately. See nsWindowSH::NewResolve().
return NS_OK;
}
PRUint32 langID;
NS_STID_FOR_ID(langID) {
void *glob = GetScriptGlobal(langID);
ctx = GetScriptContext(langID);
if (glob && ctx) {
nsresult rv = ctx->SetProperty(glob, "arguments", aArguments);
NS_ENSURE_SUCCESS(rv, rv);
}
}
return NS_OK;
}
@@ -6080,7 +6114,43 @@ nsGlobalWindow::ShowModalDialog(const nsAString& aURI, nsIVariant *aArgs,
nsCOMPtr<nsIDOMModalContentWindow> dlgInner(do_QueryInterface(inner));
if (dlgInner) {
dlgInner->GetReturnValue(aRetVal);
nsCOMPtr<nsIPrincipal> subjectPrincipal;
rv = nsContentUtils::GetSecurityManager()->
GetSubjectPrincipal(getter_AddRefs(subjectPrincipal));
if (NS_FAILED(rv)) {
return rv;
}
PRBool canAccess = PR_TRUE;
if (subjectPrincipal) {
nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
do_QueryInterface(dlgWin);
nsCOMPtr<nsIPrincipal> dialogPrincipal;
if (objPrincipal) {
dialogPrincipal = objPrincipal->GetPrincipal();
rv = subjectPrincipal->Subsumes(dialogPrincipal, &canAccess);
NS_ENSURE_SUCCESS(rv, rv);
} else {
// Uh, not sure what kind of dialog this is. Prevent access to
// be on the safe side...
canAccess = PR_FALSE;
}
}
if (canAccess) {
nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(dlgWin));
nsPIDOMWindow *inner = win->GetCurrentInnerWindow();
nsCOMPtr<nsIDOMModalContentWindow> dlgInner(do_QueryInterface(inner));
if (dlgInner) {
dlgInner->GetReturnValue(aRetVal);
}
}
}
return NS_OK;
@@ -7305,7 +7375,7 @@ nsGlobalWindow::OpenInternal(const nsAString& aUrl, const nsAString& aName,
"Shouldn't have caller context when called noscript");
*aReturn = nsnull;
nsCOMPtr<nsIWebBrowserChrome> chrome;
GetWebBrowserChrome(getter_AddRefs(chrome));
if (!chrome) {
@@ -8949,7 +9019,14 @@ nsGlobalModalWindow::GetDialogArguments(nsIArray **aArguments)
FORWARD_TO_INNER_MODAL_CONTENT_WINDOW(GetDialogArguments, (aArguments),
NS_ERROR_NOT_INITIALIZED);
*aArguments = mArguments;
PRBool subsumes = PR_FALSE;
if (mArgumentsOrigin &&
NS_SUCCEEDED(mArgumentsOrigin->Subsumes(GetPrincipal(), &subsumes)) &&
subsumes) {
NS_IF_ADDREF(*aArguments = mArguments);
} else {
*aArguments = nsnull;
}
return NS_OK;
}
@@ -8974,6 +9051,20 @@ nsGlobalModalWindow::SetReturnValue(nsIVariant *aRetVal)
return NS_OK;
}
nsresult
nsGlobalModalWindow::SetNewDocument(nsIDocument *aDocument,
nsISupports *aState,
PRBool aClearScopeHint)
{
// If we're loading a new document into a modal dialog, clear the
// return value that was set, if any, by the current document.
if (aDocument) {
mReturnValue = nsnull;
}
return nsGlobalWindow::SetNewDocument(aDocument, aState, aClearScopeHint);
}
//*****************************************************************************
// nsGlobalWindow: Creator Function (This should go away)
//*****************************************************************************

13
mozilla/dom/src/base/nsGlobalWindow.h
View File

@@ -221,7 +221,7 @@ private:
// belonging to the same outer window, but that's an unimportant
// side effect of inheriting PRCList).
class nsGlobalWindow : public nsPIDOMWindow,
class nsGlobalWindow : public nsPIDOMWindow_1_9_0,
public nsIScriptGlobalObject,
public nsIDOMJSWindow,
public nsIScriptObjectPrincipal,
@@ -333,8 +333,8 @@ public:
virtual NS_HIDDEN_(void) SetDocShell(nsIDocShell* aDocShell);
virtual NS_HIDDEN_(nsresult) SetNewDocument(nsIDocument *aDocument,
nsISupports *aState,
PRBool aClearScopeHint);
nsISupports *aState,
PRBool aClearScopeHint);
virtual NS_HIDDEN_(void) SetOpenerWindow(nsIDOMWindowInternal *aOpener,
PRBool aOriginalOpener);
virtual NS_HIDDEN_(void) EnsureSizeUpToDate();
@@ -432,6 +432,7 @@ public:
CacheXBLPrototypeHandler(nsXBLPrototypeHandler* aKey,
nsScriptObjectHolder& aHandler);
virtual nsresult SetArguments(nsIArray *aArguments, nsIPrincipal *aOrigin);
protected:
// Object Management
@@ -446,6 +447,7 @@ protected:
nsISupports *aState,
PRBool aClearScopeHint,
PRBool aIsInternalCall);
nsresult DefineArgumentsProperty(nsIArray *aArguments);
// Get the parent, returns null if this is a toplevel window
nsIDOMWindowInternal *GetParentInternal();
@@ -682,6 +684,7 @@ protected:
nsCOMPtr<nsIControllers> mControllers;
nsCOMPtr<nsIArray> mArguments;
nsCOMPtr<nsIArray> mArgumentsLast;
nsCOMPtr<nsIPrincipal> mArgumentsOrigin;
nsRefPtr<nsNavigator> mNavigator;
nsRefPtr<nsScreen> mScreen;
nsRefPtr<nsHistory> mHistory;
@@ -793,6 +796,10 @@ public:
NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsGlobalModalWindow, nsGlobalWindow)
virtual NS_HIDDEN_(nsresult) SetNewDocument(nsIDocument *aDocument,
nsISupports *aState,
PRBool aClearScopeHint);
protected:
nsCOMPtr<nsIVariant> mReturnValue;
};

2
mozilla/dom/tests/mochitest/bugs/Makefile.in
View File

@@ -79,6 +79,8 @@ _TEST_FILES = \
iframe_bug430276-2.html \
test_bug440572.html \
iframe_bug440572.html \
test_bug504862.html \
file_bug504862.html \
$(NULL)
libs:: $(_TEST_FILES)

22
mozilla/dom/tests/mochitest/bugs/file_bug504862.html Normal file
View File

@@ -0,0 +1,22 @@
<html>
<body>
<script>
window.returnValue = 3;
if (location.toString().match(/^http:\/\/localhost:8888/)) {
// Test that we got the right arguments.
opener.is(window.dialogArguments, "my args",
"dialog did not get the right arguments.");
// Load a different url, and test that it doesn't see the arguments.
window.location="data:text/html,<html><body onload=\"opener.is(window.dialogArguments, null, 'subsequent dialog document did not get the right arguments.'); close();\">';";
} else {
// Post a message containing our arguments to the opener to test
// that this cross origing dialog does *not* see the passed in
// arguments.
opener.postMessage("args: " + window.dialogArguments,
"http://localhost:8888");
close();
}
</script>

37
mozilla/dom/tests/mochitest/bugs/test_bug504862.html Normal file
View File

@@ -0,0 +1,37 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=504862
-->
<head>
<title>Test for Bug 504862</title>
<script type="text/javascript" src="/MochiKit/packed.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=504862">Mozilla Bug 504862</a>
<script class="testbody" type="text/javascript">
/** Test for Bug 504862 **/
function onMsgRcv(event)
{
is(event.data, "args: undefined", "Unexpected cross origin dialog arguments.");
}
window.addEventListener("message", onMsgRcv, false);
var subsequentDlg = "data:text/html,<html><body onload='opener.is(window.dialogArguments, \'my args\', \'subsequent dialog document did not get the right arguments.\'); close();'>";
var result = window.showModalDialog("file_bug504862.html", "my args");
is(result, null, "window sees previous dialog documents return value.");
result = window.showModalDialog("http://test1.example.com/tests/dom/tests/mochitest/bugs/file_bug504862.html", "my args");
is(result, null, "Able to see return value from cross origin dialog.");
</script>
</pre>
</body>
</html>

24
mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
View File

@@ -60,6 +60,7 @@
#include "nsIDOMWindow.h"
#include "nsIDOMChromeWindow.h"
#include "nsIDOMWindowInternal.h"
#include "nsIDOMModalContentWindow.h"
#include "nsIScriptObjectPrincipal.h"
#include "nsIScreen.h"
#include "nsIScreenManager.h"
@@ -569,11 +570,21 @@ nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow *aParent,
SizeSpec sizeSpec;
CalcSizeSpec(features.get(), sizeSpec);
PRBool isCallerChrome = PR_FALSE;
nsCOMPtr<nsIScriptSecurityManager>
sm(do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID));
if (sm)
sm->SubjectPrincipalIsSystem(&isCallerChrome);
// Remember who's calling us. This code used to assume a null
// subject principal if it failed to get the principal, but that's
// just not safe, so bail on errors here.
nsCOMPtr<nsIPrincipal> callerPrincipal;
rv = sm->GetSubjectPrincipal(getter_AddRefs(callerPrincipal));
NS_ENSURE_SUCCESS(rv, rv);
PRBool isCallerChrome = PR_TRUE;
if (callerPrincipal) {
rv = sm->IsSystemPrincipal(callerPrincipal, &isCallerChrome);
NS_ENSURE_SUCCESS(rv, rv);
}
JSContext *cx = GetJSContextFromWindow(aParent);
@@ -735,9 +746,10 @@ nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow *aParent,
if ((aDialog || windowIsModalContentDialog) && argv) {
// Set the args on the new window.
nsCOMPtr<nsIScriptGlobalObject> scriptGlobal(do_QueryInterface(*_retval));
NS_ENSURE_TRUE(scriptGlobal, NS_ERROR_UNEXPECTED);
rv = scriptGlobal->SetNewArguments(argv);
nsCOMPtr<nsPIDOMWindow_1_9_0> piwin(do_QueryInterface(*_retval));
NS_ENSURE_TRUE(piwin, NS_ERROR_UNEXPECTED);
rv = piwin->SetArguments(argv, callerPrincipal);
NS_ENSURE_SUCCESS(rv, rv);
}