Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing bugscape 3109, LiveConnect exploit. sr=jband, brendan.

Browse Source 
Fixing 58021, exploit in "open in new window," bug 55237. sr=brendan


git-svn-id: svn://10.0.0.236/trunk@82368 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mstoltz%netscape.com
2000-11-07 01:14:08 +00:00
parent b095cbfba5
commit 5b27bdf415
3 changed files with 47 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mozilla/caps/idl/nsIScriptSecurityManager.idl
View File

@@ -30,7 +30,7 @@
interface nsIURI;
[uuid(58df5780-8006-11d2-bd91-00805f8ae3f4)]
[scriptable, uuid(58df5780-8006-11d2-bd91-00805f8ae3f4)]
interface nsIScriptSecurityManager : nsISupports
{
///////////////// Principals ///////////////////////
@@ -69,7 +69,7 @@ interface nsIScriptSecurityManager : nsISupports
* @param prop The ordinal of the property being accessed (see nsDOMPropEnums.h)
* @param isWrite True if write access is being attempted
*/
void CheckScriptAccess(in JSContextPtr cx, in voidPtr obj,
[noscript] void CheckScriptAccess(in JSContextPtr cx, in voidPtr obj,
in long prop, in boolean isWrite);
/**
@@ -81,7 +81,7 @@ interface nsIScriptSecurityManager : nsISupports
* @param cx the JSContext of the script causing the load
* @param uri the URI that is being loaded
*/
void CheckLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
[noscript] void CheckLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
/**
* Default CheckLoadURI permissions
@@ -122,8 +122,8 @@ interface nsIScriptSecurityManager : nsISupports
* @param funObj The function trying to run..
* @param targetObj The object the function will run on.
*/
void CheckFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
in voidPtr targetObj);
[noscript] void CheckFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
in voidPtr targetObj);
/**
* Return true if content from the given principal is allowed to

23
mozilla/caps/src/nsScriptSecurityManager.cpp
View File

@@ -1102,6 +1102,29 @@ nsScriptSecurityManager::GetPrincipalAndFrame(JSContext *cx,
return NS_OK;
}
}
//-- If there's no principal on the stack, look at the global object
// and return the innermost frame for annotations.
if (cx)
{
nsCOMPtr<nsIScriptContext> scriptContext =
NS_REINTERPRET_CAST(nsIScriptContext*,JS_GetContextPrivate(cx));
if (scriptContext)
{
nsCOMPtr<nsIScriptGlobalObject> global = scriptContext->GetGlobalObject();
NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
nsCOMPtr<nsIScriptObjectPrincipal> globalData = do_QueryInterface(global);
NS_ENSURE_TRUE(globalData, NS_ERROR_FAILURE);
globalData->GetPrincipal(result);
if (*result)
{
JSStackFrame *inner = nsnull;
*frameResult = JS_FrameIterator(cx, &inner);
return NS_OK;
}
}
}
*result = nsnull;
return NS_OK;
}

19
mozilla/xpfe/browser/resources/content/navigator.js
View File

@@ -929,6 +929,25 @@ function RevealSearchPanel()
}
function openNewWindowWith( url ) {
// URL Loading Security Check
const nsIStandardURL = Components.interfaces.nsIStandardURL;
const nsIURI = Components.interfaces.nsIURI;
const stdURL = Components.classes["@mozilla.org/network/standard-url;1"];
var sourceURL = stdURL.createInstance(nsIStandardURL);
var focusedWindow = document.commandDispatcher.focusedWindow;
var sourceWin = isDocumentFrame(focusedWindow) ? focusedWindow.location.href : window._content.location.href;
sourceURL.init(nsIStandardURL.URLTYPE_STANDARD, 80, sourceWin, null);
var targetURL = stdURL.createInstance(nsIStandardURL);
targetURL.init(nsIStandardURL.URLTYPE_STANDARD, 80, url, null);
const nsIScriptSecurityManager = Components.interfaces.nsIScriptSecurityManager;
var secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"].getService().
QueryInterface(nsIScriptSecurityManager);
secMan.CheckLoadURI(sourceURL, targetURL, nsIScriptSecurityManager.STANDARD);
var newWin;
var wintype = document.firstChild.getAttribute('windowtype');