Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix 18439 windows.status allows reading links

Browse Source 
r=mstoltz


git-svn-id: svn://10.0.0.236/trunk@60428 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
norris%netscape.com 2000-02-11 04:18:39 +00:00
parent 1b7a0dd5ff
commit 78ff426219
5 changed files with 39 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
mozilla/caps/src/nsScriptSecurityManager.cpp
View File

@ -629,7 +629,8 @@ nsScriptSecurityManager::CanExecuteScripts(nsIPrincipal *principal,
if (NS_FAILED(uri->GetScheme(getter_Copies(scheme))))
return NS_ERROR_FAILURE;
if (nsCRT::strcmp(scheme, "imap") == 0 ||
nsCRT::strcmp(scheme, "mailbox") == 0)
nsCRT::strcmp(scheme, "mailbox") == 0 ||
nsCRT::strcmp(scheme, "news") == 0)
{
*result = mIsMailJavaScriptEnabled;
return NS_OK;
@ -1075,9 +1076,7 @@ nsScriptSecurityManager::GetScriptSecurityManager()
if (NS_SUCCEEDED(rv) && xpc) {
rv = xpc->SetDefaultSecurityManager(
NS_STATIC_CAST(nsIXPCSecurityManager*, ssecMan),
nsIXPCSecurityManager::HOOK_CREATE_WRAPPER |
nsIXPCSecurityManager::HOOK_CREATE_INSTANCE |
nsIXPCSecurityManager::HOOK_GET_SERVICE);
nsIXPCSecurityManager::HOOK_ALL);
if (NS_FAILED(rv)) {
NS_WARNING("failed to install xpconnect security manager!");
}
@ -1356,15 +1355,21 @@ findDomProp(const char *propName, int n)
do {
int mid = (hi + lo) / 2;
int cmp = PL_strncmp(propName, domPropNames[mid], n);
if (cmp == 0)
return (nsDOMProp) mid;
if (cmp == 0) {
if (domPropNames[mid][n] == '\0')
return (nsDOMProp) mid;
cmp = -1;
}
if (cmp < 0)
hi = mid - 1;
else
lo = mid + 1;
} while (hi > lo);
if (PL_strncmp(propName, domPropNames[lo], n) == 0)
if (PL_strncmp(propName, domPropNames[lo], n) == 0 &&
domPropNames[lo][n] == '\0')
{
return (nsDOMProp) lo;
}
return NS_DOM_PROP_MAX;
}

1
mozilla/dom/public/nsDOMPropEnums.h
View File

@ -613,6 +613,7 @@ enum nsDOMProp {
NS_DOM_PROP_LOCATION_HASH,
NS_DOM_PROP_LOCATION_HOST,
NS_DOM_PROP_LOCATION_HOSTNAME,
NS_DOM_PROP_LOCATION_HREF,
NS_DOM_PROP_LOCATION_PATHNAME,
NS_DOM_PROP_LOCATION_PORT,
NS_DOM_PROP_LOCATION_PROTOCOL,

1
mozilla/dom/public/nsDOMPropNames.h
View File

@ -612,6 +612,7 @@
"location.hash", \
"location.host", \
"location.hostname", \
"location.href", \
"location.pathname", \
"location.port", \
"location.protocol", \

27
mozilla/dom/src/base/nsLocation.cpp
View File

@ -41,6 +41,8 @@
#include "nsIDocument.h"
#include "nsIJSContextStack.h"
#include "nsXPIDLString.h"
#include "nsDOMPropEnums.h"
#include "nsDOMError.h"
static NS_DEFINE_IID(kIScriptObjectOwnerIID, NS_ISCRIPTOBJECTOWNER_IID);
static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
@ -738,18 +740,35 @@ LocationImpl::DeleteProperty(JSContext *aContext, JSObject *aObj, jsval aID, jsv
return JS_TRUE;
}
static nsresult
CheckHrefAccess(JSContext *aContext, JSObject *aObj, PRBool isWrite)
{
nsresult rv;
NS_WITH_SERVICE(nsIScriptSecurityManager, secMan,
NS_SCRIPTSECURITYMANAGER_PROGID, &rv);
if (NS_FAILED(rv))
rv = NS_ERROR_DOM_SECMAN_ERR;
else
rv = secMan->CheckScriptAccess(aContext, aObj, NS_DOM_PROP_LOCATION_HREF,
isWrite);
if (NS_FAILED(rv))
return nsJSUtils::nsReportError(aContext, aObj, rv);
return NS_OK;
}
PRBool
LocationImpl::GetProperty(JSContext *aContext, JSObject *aObj, jsval aID, jsval *aVp)
{
PRBool result = PR_TRUE;
// XXX Security manager needs to be called
if (JSVAL_IS_STRING(aID)) {
char* cString = JS_GetStringBytes(JS_ValueToString(aContext, aID));
if (PL_strcmp("href", cString) == 0) {
nsAutoString href;
if (NS_SUCCEEDED(GetHref(href))) {
if (NS_SUCCEEDED(CheckHrefAccess(aContext, aObj, PR_FALSE)) &&
NS_SUCCEEDED(GetHref(href)))
{
const PRUnichar* bytes = href.GetUnicode();
JSString* str = JS_NewUCStringCopyZ(aContext, (const jschar*)bytes);
if (str) {
@ -772,7 +791,6 @@ LocationImpl::SetProperty(JSContext *aContext, JSObject *aObj, jsval aID, jsval
{
nsresult result = NS_OK;
// XXX Security manager needs to be called
if (JSVAL_IS_STRING(aID)) {
char* cString = JS_GetStringBytes(JS_ValueToString(aContext, aID));
@ -780,6 +798,9 @@ LocationImpl::SetProperty(JSContext *aContext, JSObject *aObj, jsval aID, jsval
nsIURI* base;
nsAutoString href;
if (NS_FAILED(CheckHrefAccess(aContext, aObj, PR_TRUE)))
return PR_FALSE;
// Get the parameter passed in
nsJSUtils::nsConvertJSValToString(href, aContext, *aVp);

1
mozilla/modules/libpref/src/init/all.js
View File

@ -368,6 +368,7 @@ pref("security.policy.default.htmlimageelement.lowsrc", "sameOrigin");
pref("security.policy.default.location.hash.read", "sameOrigin");
pref("security.policy.default.location.host.read", "sameOrigin");
pref("security.policy.default.location.hostname.read", "sameOrigin");
pref("security.policy.default.location.href.read", "sameOrigin");
pref("security.policy.default.location.pathname.read", "sameOrigin");
pref("security.policy.default.location.port.read", "sameOrigin");
pref("security.policy.default.location.protocol.read", "sameOrigin");