From 8b16c623f4a8c5ab2474b9066202c0e76fc5bfcf Mon Sep 17 00:00:00 2001
From: "bent.mozilla%gmail.com"
 <bent.mozilla%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 28 Apr 2008 23:56:13 +0000
Subject: [PATCH] Bug 379959. Patch by Jonas Sicking <jonas@sicking.cc>.
 r+sr=bz, a=damons.

git-svn-id: svn://10.0.0.236/trunk@250900 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/build/pgo/automation.py.in            |  1 +
 mozilla/content/base/public/nsContentUtils.h  |  1 +
 mozilla/content/base/src/nsContentUtils.cpp   | 23 ++++++
 mozilla/content/xbl/src/nsXBLService.cpp      |  8 +-
 mozilla/content/xbl/src/nsXBLService.h        |  3 +
 mozilla/content/xbl/test/Makefile.in          |  6 +-
 .../xbl/test/file_bug379959_cross.html        | 25 ++++++
 .../content/xbl/test/file_bug379959_data.html | 18 ++++
 .../content/xbl/test/file_bug379959_xbl.xml   |  4 +
 mozilla/content/xbl/test/test_bug379959.html  | 82 +++++++++++++++++++
 mozilla/testing/mochitest/runtests.pl.in      |  1 +
 .../tools/profiles/createTestingProfile.py    |  3 +-
 12 files changed, 171 insertions(+), 4 deletions(-)
 create mode 100644 mozilla/content/xbl/test/file_bug379959_cross.html
 create mode 100644 mozilla/content/xbl/test/file_bug379959_data.html
 create mode 100644 mozilla/content/xbl/test/file_bug379959_xbl.xml
 create mode 100644 mozilla/content/xbl/test/test_bug379959.html

diff --git a/mozilla/build/pgo/automation.py.in b/mozilla/build/pgo/automation.py.in
index 09cc15acab6..c48564aef1f 100644
--- a/mozilla/build/pgo/automation.py.in
+++ b/mozilla/build/pgo/automation.py.in
@@ -240,6 +240,7 @@ user_pref("browser.shell.checkDefaultBrowser", false);
 user_pref("browser.warnOnQuit", false);
 user_pref("accessibility.typeaheadfind.autostart", false);
 user_pref("javascript.options.showInConsole", true);
+user_pref("layout.debug.enable_data_xbl", true);
 """
   prefs.append(part)
 
diff --git a/mozilla/content/base/public/nsContentUtils.h b/mozilla/content/base/public/nsContentUtils.h
index 7d9df7b166c..b1898a26b5a 100644
--- a/mozilla/content/base/public/nsContentUtils.h
+++ b/mozilla/content/base/public/nsContentUtils.h
@@ -546,6 +546,7 @@ public:
   static void UnregisterPrefCallback(const char *aPref,
                                      PrefChangedFunc aCallback,
                                      void * aClosure);
+  static void AddBoolPrefVarCache(const char* aPref, PRBool* aVariable);
   static nsIPrefBranch *GetPrefBranch()
   {
     return sPrefBranch;
diff --git a/mozilla/content/base/src/nsContentUtils.cpp b/mozilla/content/base/src/nsContentUtils.cpp
index e81c2cac9e8..c2495699c40 100644
--- a/mozilla/content/base/src/nsContentUtils.cpp
+++ b/mozilla/content/base/src/nsContentUtils.cpp
@@ -2500,6 +2500,22 @@ nsContentUtils::UnregisterPrefCallback(const char *aPref,
     sPref->UnregisterCallback(aPref, aCallback, aClosure);
 }
 
+static int PR_CALLBACK
+BoolVarChanged(const char *aPref, void *aClosure)
+{
+  PRBool* cache = static_cast<PRBool*>(aClosure);
+  *cache = nsContentUtils::GetBoolPref(aPref, PR_FALSE);
+  
+  return 0;
+}
+
+void
+nsContentUtils::AddBoolPrefVarCache(const char *aPref,
+                                    PRBool* aCache)
+{
+  *aCache = GetBoolPref(aPref, PR_FALSE);
+  RegisterPrefCallback(aPref, BoolVarChanged, aCache);
+}
 
 static const char *gEventNames[] = {"event"};
 static const char *gSVGEventNames[] = {"evt"};
@@ -3844,6 +3860,13 @@ nsContentUtils::CheckSecurityBeforeLoad(nsIURI* aURIToLoad,
                                         nsISupports* aExtra)
 {
   NS_PRECONDITION(aLoadingPrincipal, "Must have a loading principal here");
+
+  PRBool isSystemPrin = PR_FALSE;
+  if (NS_SUCCEEDED(sSecurityManager->IsSystemPrincipal(aLoadingPrincipal,
+                                                       &isSystemPrin)) &&
+      isSystemPrin) {
+    return NS_OK;
+  }
   
   // XXXbz do we want to fast-path skin stylesheets loading XBL here somehow?
   // CheckLoadURIWithPrincipal
diff --git a/mozilla/content/xbl/src/nsXBLService.cpp b/mozilla/content/xbl/src/nsXBLService.cpp
index 5d8a5006f4b..6a863158fac 100644
--- a/mozilla/content/xbl/src/nsXBLService.cpp
+++ b/mozilla/content/xbl/src/nsXBLService.cpp
@@ -427,7 +427,8 @@ nsXBLStreamListener::Load(nsIDOMEvent* aEvent)
 
 // Static member variable initialization
 PRUint32 nsXBLService::gRefCnt = 0;
- 
+PRBool nsXBLService::gAllowDataURIs = PR_FALSE;
+
 nsHashtable* nsXBLService::gClassTable = nsnull;
 
 JSCList  nsXBLService::gClassLRUList = JS_INIT_STATIC_CLIST(&nsXBLService::gClassLRUList);
@@ -446,6 +447,9 @@ nsXBLService::nsXBLService(void)
   if (gRefCnt == 1) {
     gClassTable = new nsHashtable();
   }
+  
+  nsContentUtils::AddBoolPrefVarCache("layout.debug.enable_data_xbl",
+                                      &gAllowDataURIs);
 }
 
 nsXBLService::~nsXBLService(void)
@@ -958,7 +962,7 @@ nsXBLService::LoadBindingDocumentInfo(nsIContent* aBoundElement,
     rv = nsContentUtils::
       CheckSecurityBeforeLoad(aBindingURI, aOriginPrincipal,
                               nsIScriptSecurityManager::ALLOW_CHROME,
-                              PR_TRUE,
+                              gAllowDataURIs,
                               nsIContentPolicy::TYPE_XBL,
                               aBoundDocument);
     NS_ENSURE_SUCCESS(rv, rv);
diff --git a/mozilla/content/xbl/src/nsXBLService.h b/mozilla/content/xbl/src/nsXBLService.h
index d8c506b7f98..b6bb9a2ebdc 100644
--- a/mozilla/content/xbl/src/nsXBLService.h
+++ b/mozilla/content/xbl/src/nsXBLService.h
@@ -150,6 +150,9 @@ public:
   static JSCList  gClassLRUList;             // LRU list of cached classes.
   static PRUint32 gClassLRUListLength;       // Number of classes on LRU list.
   static PRUint32 gClassLRUListQuota;        // Quota on class LRU list.
+  static PRBool   gAllowDataURIs;            // Whether we should allow data
+                                             // urls in -moz-binding. Needed for
+                                             // testing.
 
   nsFixedSizeAllocator mPool;
 };
diff --git a/mozilla/content/xbl/test/Makefile.in b/mozilla/content/xbl/test/Makefile.in
index 9deb767bd31..28037a7968b 100644
--- a/mozilla/content/xbl/test/Makefile.in
+++ b/mozilla/content/xbl/test/Makefile.in
@@ -49,6 +49,7 @@ include $(topsrcdir)/config/rules.mk
 _TEST_FILES =	\
 		test_bug296375.xul \
 		test_bug310107.html \
+		bug310107-resource.xhtml \
 		test_bug366770.html \
 		test_bug371724.xhtml \
 		test_bug372769.xhtml \
@@ -60,7 +61,10 @@ _TEST_FILES =	\
 		test_bug400705.xhtml \
 		test_bug401907.xhtml \
 		test_bug403162.xhtml \
-		bug310107-resource.xhtml \
+		test_bug379959.html \
+		file_bug379959_data.html \
+		file_bug379959_cross.html \
+		file_bug379959_xbl.xml \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/mozilla/content/xbl/test/file_bug379959_cross.html b/mozilla/content/xbl/test/file_bug379959_cross.html
new file mode 100644
index 00000000000..21e11497adf
--- /dev/null
+++ b/mozilla/content/xbl/test/file_bug379959_cross.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style>
+#div1 {
+  color: green;
+  -moz-binding: url(file_bug379959_xbl.xml#xbltest);
+}
+#div2 {
+  color: green;
+  -moz-binding: url(http://example.com/tests/content/xbl/test/file_bug379959_xbl.xml#xbltest);
+}
+</style>
+<body>
+<div id="div1"></div>
+<div id="div2"></div>
+<script>
+onload = function() {
+  nodes = document.getAnonymousNodes(document.getElementById('div1'));
+  parent.postMessage(nodes ? nodes.length : 0);
+  nodes = document.getAnonymousNodes(document.getElementById('div2'));
+  parent.postMessage(nodes ? nodes.length : 0);
+}
+</script>
+</html>
diff --git a/mozilla/content/xbl/test/file_bug379959_data.html b/mozilla/content/xbl/test/file_bug379959_data.html
new file mode 100644
index 00000000000..ae9d94302d6
--- /dev/null
+++ b/mozilla/content/xbl/test/file_bug379959_data.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style>
+#d {
+  color: green;
+  -moz-binding: url(data:text/xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3Cbindings%20id%3D%22xbltestBindings%22%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%20%20%3Cbinding%20id%3D%22xbltest%22%3E%3Ccontent%3EPASS%3C/content%3E%3C/binding%3E%0A%3C/bindings%3E%0A);
+}
+</style>
+<body>
+<div id="d"></div>
+<script>
+onload = function() {
+  nodes = document.getAnonymousNodes(document.getElementById('d'));
+  parent.postMessage(nodes ? nodes.length : 0);
+}
+</script>
+</html>
diff --git a/mozilla/content/xbl/test/file_bug379959_xbl.xml b/mozilla/content/xbl/test/file_bug379959_xbl.xml
new file mode 100644
index 00000000000..c791a2e2b42
--- /dev/null
+++ b/mozilla/content/xbl/test/file_bug379959_xbl.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<bindings id="xbltestBindings" xmlns="http://www.mozilla.org/xbl">
+  <binding id="xbltest"><content>PASS</content></binding>
+</bindings>
diff --git a/mozilla/content/xbl/test/test_bug379959.html b/mozilla/content/xbl/test/test_bug379959.html
new file mode 100644
index 00000000000..fdda4f2e241
--- /dev/null
+++ b/mozilla/content/xbl/test/test_bug379959.html
@@ -0,0 +1,82 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=366770
+-->
+<head>
+  <title>Test for Bug 366770</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="gen.next();">
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=366770">Mozilla Bug 366770</a>
+  <p id="display">
+    Note: In order to re-run this test correctly you need to shift-reload
+    rather than simply reload. If you just reload we will restore the
+    previous url in the iframe which will result in an extra unexpected
+    message.
+  </p>
+  <div id="content" style="display: none"></div>
+  <iframe id="f"></iframe>
+
+  <pre id="test">
+    <script class="testbody" type="application/javascript;version=1.7">
+SimpleTest.waitForExplicitFinish();
+
+gen = runTest();
+var messages = 0;
+
+document.addEventListener("message",
+                          function(e) { messages++; gen.send(e.data); },
+                          false);
+
+const prefName = "layout.debug.enable_data_xbl";
+
+function runTest() {
+  iframe = document.getElementById('f');
+
+  // Turn on loads of data-urls
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  var prefs = Components.classes["@mozilla.org/preferences-service;1"]
+    .getService(Components.interfaces.nsIPrefBranch);
+  var oldPrefVal = undefined;
+  if (prefs.prefHasUserValue(prefName)) {
+    oldPrefVal = prefs.getBoolPref(prefName);
+  }
+
+  // Test with data-urls off
+  prefs.setBoolPref(prefName, false);
+  iframe.src = "file_bug379959_data.html";
+  is((yield), 0, "data-url load should have failed");
+
+  // Test with data-urls on
+  prefs.setBoolPref(prefName, true);
+  iframe.src = "file_bug379959_data.html";
+  is((yield), 1, "data-url load should have been successful");
+
+  // Try a cross-site load
+  iframe.src = "file_bug379959_cross.html";
+  is((yield), 1, "same site load should have succeeded");
+  is((yield), 0, "cross site load should have failed");
+
+  // Check that we got the right number of messages to make sure that
+  // the right message has aligned with the right test
+  is(messages, 4, "wrong number of messages");
+
+  // We're done
+  if (oldPrefVal === undefined) {
+    prefs.clearUserPref(prefName);
+  }
+  else {
+    prefs.setBoolPref(prefName, oldPrefVal);
+  }
+
+  SimpleTest.finish();
+
+  yield;
+}
+    </script>
+  </pre>
+</body>
+</html>
diff --git a/mozilla/testing/mochitest/runtests.pl.in b/mozilla/testing/mochitest/runtests.pl.in
index cd20d64f296..0d956bc36f3 100644
--- a/mozilla/testing/mochitest/runtests.pl.in
+++ b/mozilla/testing/mochitest/runtests.pl.in
@@ -438,6 +438,7 @@ user_pref("browser.shell.checkDefaultBrowser", false);
 user_pref("browser.warnOnQuit", false);
 user_pref("accessibility.typeaheadfind.autostart", false);
 user_pref("javascript.options.showInConsole", true);
+user_pref("layout.debug.enable_data_xbl", true);
 PREFEND
 
   # Grant God-power to all the servers on which tests can run.
diff --git a/mozilla/testing/tools/profiles/createTestingProfile.py b/mozilla/testing/tools/profiles/createTestingProfile.py
index 4c100021681..6cdc32ff697 100644
--- a/mozilla/testing/tools/profiles/createTestingProfile.py
+++ b/mozilla/testing/tools/profiles/createTestingProfile.py
@@ -23,7 +23,8 @@ userPrefs = {
     'dom.disable_window_move_resize': 'false',
     'layout.fire_onload_after_image_background_loads': 'true',
     'javascript.options.showInConsole': 'true',
-    'privacy.popups.firstTime': 'false'
+    'privacy.popups.firstTime': 'false',
+    'layout.debug.enable_data_xbl': 'true'
 }
 
 def usage():