From 7bf513acb6dcfe613ee751a4296d91b190d321be Mon Sep 17 00:00:00 2001
From: "mstoltz%netscape.com"
 <mstoltz%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 31 Aug 2001 21:01:10 +0000
Subject: [PATCH] Bug 92061 - allow javascript: URLs to be targeted at
 about:blank windows. Relaxing too-strict security policy. r=rginda, sr=jst,
 a=asa

git-svn-id: svn://10.0.0.236/trunk@102096 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp | 46 +++++++++++++------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp b/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp
index 1b8c877a55a..a36f7a5ae6d 100644
--- a/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp
+++ b/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp
@@ -37,12 +37,14 @@
 #include "nsIScriptGlobalObjectOwner.h"
 #include "nsIPrincipal.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsICodebasePrincipal.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIByteArrayInputStream.h"
 #include "nsIWindowMediator.h"
 #include "nsIDOMWindowInternal.h"
 #include "nsIJSConsoleService.h"
 #include "nsIConsoleService.h"
+#include "nsXPIDLString.h"
 
 static NS_DEFINE_CID(kSimpleURICID, NS_SIMPLEURI_CID);
 static NS_DEFINE_CID(kWindowMediatorCID, NS_WINDOWMEDIATOR_CID);
@@ -175,9 +177,10 @@ nsresult nsJSThunk::EvaluateScript()
         if (!principal)
             return NS_ERROR_FAILURE;
 
-
         //-- Don't run if the script principal is different from the
-        //   principal of the context
+        //   principal of the context, with two exceptions: we allow
+        //   the script to run if the script has the system principal
+        //   or the context is about:blank.
         nsCOMPtr<nsIPrincipal> objectPrincipal;
         rv = securityManager->GetObjectPrincipal(
                                 (JSContext*)scriptContext->GetNativeContext(),
@@ -185,19 +188,34 @@ nsresult nsJSThunk::EvaluateScript()
                                 getter_AddRefs(objectPrincipal));
         if (NS_FAILED(rv))
             return rv;
-        nsCOMPtr<nsIPrincipal> systemPrincipal;
-        securityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
+
         PRBool equals = PR_FALSE;
-        if (principal.get() != systemPrincipal.get() &&
-            (NS_FAILED(objectPrincipal->Equals(principal, &equals)) || !equals)) {
-           // Don't run the script. Print a message to the console and
-           // return undefined.
-           nsCOMPtr<nsIConsoleService> console(do_GetService("@mozilla.org/consoleservice;1"));
-           if (console) {
-               console->LogStringMessage(
-                        NS_LITERAL_STRING("Attempt to load a javascript: URL from one host\nin a window displaying content from another host\nwas blocked by the security manager.").get());
-           }
-           return NS_ERROR_DOM_RETVAL_UNDEFINED;
+        if ((NS_FAILED(objectPrincipal->Equals(principal, &equals)) || !equals)) {
+            // If the principals aren't equal
+
+            nsCOMPtr<nsIPrincipal> systemPrincipal;
+            securityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
+            if (principal.get() != systemPrincipal.get()) {
+                // and the script to be run does not have the system principal
+
+                nsCOMPtr<nsICodebasePrincipal> 
+                    objectCodebase(do_QueryInterface(objectPrincipal));
+                nsXPIDLCString objectOrigin;
+                rv = objectCodebase->GetOrigin(getter_Copies(objectOrigin));
+                if (PL_strcmp("about:blank", objectOrigin) != 0) {
+                    // and the target window is not about:blank, then
+                    // don't run the script. Print a message to the console and
+                    // return undefined.
+
+                    nsCOMPtr<nsIConsoleService> 
+                        console(do_GetService("@mozilla.org/consoleservice;1"));
+                    if (console) {
+                            console->LogStringMessage(
+                                NS_LITERAL_STRING("Attempt to load a javascript: URL from one host\nin a window displaying content from another host\nwas blocked by the security manager.").get());
+                    }
+                    return NS_ERROR_DOM_RETVAL_UNDEFINED;
+                }
+            }
         }
     }
     else {