From 5b27bdf4153b8b73b5e2d52e4975881b5a6ea30f Mon Sep 17 00:00:00 2001
From: "mstoltz%netscape.com"
 <mstoltz%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 7 Nov 2000 01:14:08 +0000
Subject: [PATCH] Fixing bugscape 3109, LiveConnect exploit. sr=jband, brendan.
 Fixing 58021, exploit in "open in new window," bug 55237. sr=brendan

git-svn-id: svn://10.0.0.236/trunk@82368 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/caps/idl/nsIScriptSecurityManager.idl | 10 ++++----
 mozilla/caps/src/nsScriptSecurityManager.cpp  | 23 +++++++++++++++++++
 .../browser/resources/content/navigator.js    | 19 +++++++++++++++
 3 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/mozilla/caps/idl/nsIScriptSecurityManager.idl b/mozilla/caps/idl/nsIScriptSecurityManager.idl
index 5f82d27a8d4..70fac17b031 100644
--- a/mozilla/caps/idl/nsIScriptSecurityManager.idl
+++ b/mozilla/caps/idl/nsIScriptSecurityManager.idl
@@ -30,7 +30,7 @@
 
 interface nsIURI;
 
-[uuid(58df5780-8006-11d2-bd91-00805f8ae3f4)]
+[scriptable, uuid(58df5780-8006-11d2-bd91-00805f8ae3f4)]
 interface nsIScriptSecurityManager : nsISupports
 {
 	///////////////// Principals /////////////////////// 
@@ -69,7 +69,7 @@ interface nsIScriptSecurityManager : nsISupports
      * @param prop The ordinal of the property being accessed (see nsDOMPropEnums.h)
      * @param isWrite True if write access is being attempted
      */
-	void CheckScriptAccess(in JSContextPtr cx, in voidPtr obj, 
+	[noscript] void CheckScriptAccess(in JSContextPtr cx, in voidPtr obj, 
 	                       in long prop, in boolean isWrite);
 
 	/**
@@ -81,7 +81,7 @@ interface nsIScriptSecurityManager : nsISupports
 	 * @param cx the JSContext of the script causing the load
 	 * @param uri the URI that is being loaded
 	 */
-    void CheckLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
+    [noscript] void CheckLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
 
     /** 
      * Default CheckLoadURI permissions
@@ -122,8 +122,8 @@ interface nsIScriptSecurityManager : nsISupports
    * @param funObj The function trying to run..
    * @param targetObj The object the function will run on.
    */
-    void CheckFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
-                  in voidPtr targetObj);
+    [noscript] void CheckFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
+                                        in voidPtr targetObj);
 
 	/**
 	 * Return true if content from the given principal is allowed to
diff --git a/mozilla/caps/src/nsScriptSecurityManager.cpp b/mozilla/caps/src/nsScriptSecurityManager.cpp
index c380b68d2e5..4ce3018dee8 100644
--- a/mozilla/caps/src/nsScriptSecurityManager.cpp
+++ b/mozilla/caps/src/nsScriptSecurityManager.cpp
@@ -1102,6 +1102,29 @@ nsScriptSecurityManager::GetPrincipalAndFrame(JSContext *cx,
             return NS_OK;
         }
     }
+
+    //-- If there's no principal on the stack, look at the global object
+    //   and return the innermost frame for annotations.
+    if (cx) 
+    {
+        nsCOMPtr<nsIScriptContext> scriptContext = 
+            NS_REINTERPRET_CAST(nsIScriptContext*,JS_GetContextPrivate(cx));
+        if (scriptContext)
+        {
+            nsCOMPtr<nsIScriptGlobalObject> global = scriptContext->GetGlobalObject();
+            NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+            nsCOMPtr<nsIScriptObjectPrincipal> globalData = do_QueryInterface(global);
+            NS_ENSURE_TRUE(globalData, NS_ERROR_FAILURE);
+            globalData->GetPrincipal(result);
+            if (*result)
+            {
+                JSStackFrame *inner = nsnull;
+                *frameResult = JS_FrameIterator(cx, &inner);
+                return NS_OK;
+            }
+        }
+    }   
+
     *result = nsnull;
     return NS_OK;
 }
diff --git a/mozilla/xpfe/browser/resources/content/navigator.js b/mozilla/xpfe/browser/resources/content/navigator.js
index c2734e56b5d..134103fd1c4 100644
--- a/mozilla/xpfe/browser/resources/content/navigator.js
+++ b/mozilla/xpfe/browser/resources/content/navigator.js
@@ -929,6 +929,25 @@ function RevealSearchPanel()
   }
 
   function openNewWindowWith( url ) {
+
+    // URL Loading Security Check
+    const nsIStandardURL = Components.interfaces.nsIStandardURL;
+    const nsIURI = Components.interfaces.nsIURI;
+    const stdURL = Components.classes["@mozilla.org/network/standard-url;1"];
+
+    var sourceURL = stdURL.createInstance(nsIStandardURL);
+    var focusedWindow = document.commandDispatcher.focusedWindow;
+    var sourceWin = isDocumentFrame(focusedWindow) ? focusedWindow.location.href : window._content.location.href;
+    sourceURL.init(nsIStandardURL.URLTYPE_STANDARD, 80, sourceWin, null);
+
+    var targetURL = stdURL.createInstance(nsIStandardURL);
+    targetURL.init(nsIStandardURL.URLTYPE_STANDARD, 80, url, null);
+
+    const nsIScriptSecurityManager = Components.interfaces.nsIScriptSecurityManager;
+    var secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"].getService().
+                 QueryInterface(nsIScriptSecurityManager);
+    secMan.CheckLoadURI(sourceURL, targetURL, nsIScriptSecurityManager.STANDARD);
+
     var newWin;
     var wintype = document.firstChild.getAttribute('windowtype');