From ae9379ea3e85520b4f47fe8bb1da198ddfcf22f5 Mon Sep 17 00:00:00 2001 From: "jst%mozilla.jstenback.com" Date: Wed, 6 Jul 2005 00:10:24 +0000 Subject: [PATCH] Fixing bug 299450. Add protection for __proto__. r=bzbarsky@mit.edu, sr+a=brendan@mozilla.org git-svn-id: svn://10.0.0.236/trunk@175666 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp b/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp index 7bdcb863905..e6b3a3dc468 100644 --- a/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp +++ b/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp @@ -763,6 +763,18 @@ JS_STATIC_DLL_CALLBACK(JSBool) XPC_NW_CheckAccess(JSContext *cx, JSObject *obj, jsval id, JSAccessMode mode, jsval *vp) { + // Prevent setting __proto__ on an XPCNativeWrapper + if ((mode & JSACC_WATCH) == JSACC_PROTO && (mode & JSACC_WRITE)) { + return ThrowException(NS_ERROR_XPC_SECURITY_MANAGER_VETO, cx); + } + + // Forward to the checkObjectAccess hook in the JSContext, if any. + if (cx->runtime->checkObjectAccess && + !cx->runtime->checkObjectAccess(cx, obj, id, mode, vp)) { + return JS_FALSE; + } + + // Do our own thing... XPC_NW_BYPASS_TEST(cx, obj, checkAccess, (cx, obj, id, mode, vp)); return JS_TRUE;