From b00afe5bf49494ac0eaec79d7e61d6a88735b6e2 Mon Sep 17 00:00:00 2001
From: "aaronr%us.ibm.com"
 <aaronr%us.ibm.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 25 Feb 2008 22:48:10 +0000
Subject: [PATCH] [XForms] NPOTDB nsSchemaLoader::LoadAsync fails. Bug 419106,
 r=doronr+olli

git-svn-id: svn://10.0.0.236/trunk@246480 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../public/nsISVSchemaLoader.idl              |  4 +++
 .../schema-validation/src/nsSchemaLoader.cpp  | 33 +++++++++++++++++--
 .../xforms/nsXFormsModelElement.cpp           | 16 ++++++++-
 3 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/mozilla/extensions/schema-validation/public/nsISVSchemaLoader.idl b/mozilla/extensions/schema-validation/public/nsISVSchemaLoader.idl
index bf11f315fd0..a62803dd389 100644
--- a/mozilla/extensions/schema-validation/public/nsISVSchemaLoader.idl
+++ b/mozilla/extensions/schema-validation/public/nsISVSchemaLoader.idl
@@ -47,12 +47,16 @@ interface nsISVSchema;
 interface nsISVSchemaType;
 interface nsIDOMElement;
 interface nsISVSchemaLoadListener;
+interface nsIPrincipal;
 
 [scriptable, uuid(ab374f43-73cf-4bba-925a-31ebdfc8d172)]
 interface nsISVSchemaLoader : nsISupports {
   nsISVSchema load(in AString schemaURI);
   void loadAsync(in AString schemaURI,
                  in nsISVSchemaLoadListener listener);
+  [noscript] void loadAsyncWithPrincipal(in AString schemaURI,
+                                         in nsISVSchemaLoadListener listener,
+                                         in nsIPrincipal principal);
   nsISVSchema processSchemaElement(in nsIDOMElement element,
                                    in nsISVSchemaErrorHandler aErrorHandler);
 };
diff --git a/mozilla/extensions/schema-validation/src/nsSchemaLoader.cpp b/mozilla/extensions/schema-validation/src/nsSchemaLoader.cpp
index 4655e065d74..5e24eee8014 100644
--- a/mozilla/extensions/schema-validation/src/nsSchemaLoader.cpp
+++ b/mozilla/extensions/schema-validation/src/nsSchemaLoader.cpp
@@ -702,12 +702,17 @@ nsSchemaLoader::Load(const nsAString& schemaURI,
   return rv;
 }
 
-/* void loadAsync (in AString schemaURI, in nsISVSchemaLoadListener listener); */
+/* [noscript] void loadAsyncWithPrincipal (in AString schemaURI,
+ *                                         in nsISVSchemaLoadListener listener,
+ *                                         in nsIPrincipal principal);
+ */
 NS_IMETHODIMP
-nsSchemaLoader::LoadAsync(const nsAString& schemaURI,
-                          nsISVSchemaLoadListener *aListener)
+nsSchemaLoader::LoadAsyncWithPrincipal(const nsAString& schemaURI,
+                                       nsISVSchemaLoadListener *aListener,
+                                       nsIPrincipal *aPrincipal)
 {
   NS_ENSURE_ARG(aListener);
+  NS_ENSURE_ARG(aPrincipal);
 
   nsCOMPtr<nsIURI> resolvedURI;
   nsresult rv = GetResolvedURI(schemaURI, "loadAsync", getter_AddRefs(resolvedURI));
@@ -722,6 +727,9 @@ nsSchemaLoader::LoadAsync(const nsAString& schemaURI,
     return rv;
   }
 
+  rv = request->Init(aPrincipal, nsnull, nsnull);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   const nsAString& empty = EmptyString();
   rv = request->OpenRequest(NS_LITERAL_CSTRING("GET"), spec, PR_TRUE, empty,
                             empty);
@@ -765,6 +773,25 @@ nsSchemaLoader::LoadAsync(const nsAString& schemaURI,
   return rv;
 }
 
+/* void loadAsync(in AString schemaURI, in nsISVSchemaLoadListener listener); */
+NS_IMETHODIMP
+nsSchemaLoader::LoadAsync(const nsAString& aSchemaURI,
+                          nsISVSchemaLoadListener *aListener)
+{
+  // Get the subject principal from the security manager.  We need it to
+  // initialize the nsIXMLHttpRequest inside loadAsyncWithPrincipal.
+  nsCOMPtr<nsIScriptSecurityManager> secMan =
+    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
+  NS_ENSURE_STATE(secMan);
+
+  nsCOMPtr<nsIPrincipal> principal;
+  nsresult rv = secMan->GetSubjectPrincipal(getter_AddRefs(principal));
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(principal, NS_ERROR_FAILURE);
+
+  return LoadAsyncWithPrincipal(aSchemaURI, aListener, principal);
+}
+
 static const char* kSchemaNamespaces[] = {NS_SCHEMA_1999_NAMESPACE,
                                           NS_SCHEMA_2001_NAMESPACE};
 static PRUint32 kSchemaNamespacesLength = sizeof(kSchemaNamespaces) / sizeof(const char*);
diff --git a/mozilla/extensions/xforms/nsXFormsModelElement.cpp b/mozilla/extensions/xforms/nsXFormsModelElement.cpp
index 1c956823a99..9648f8169a5 100644
--- a/mozilla/extensions/xforms/nsXFormsModelElement.cpp
+++ b/mozilla/extensions/xforms/nsXFormsModelElement.cpp
@@ -85,6 +85,7 @@
 #include "nsStringEnumerator.h"
 #include "nsIAtomService.h"
 #include "nsIAttribute.h"
+#include "nsIScriptSecurityManager.h"
 
 #define XFORMS_LAZY_INSTANCE_BINDING \
   "chrome://xforms/content/xforms.xml#xforms-lazy-instance"
@@ -809,6 +810,18 @@ nsXFormsModelElement::InitializeInstances()
     // Increase by 1 to prevent OnLoad from calling FinishConstruction
     mSchemaTotal = schemas.Count();
 
+    // Get the system principal in case we need to load a remote schema
+    // file below.  This should be safe since this calls
+    // nsSchemaLoader::LoadAsyncWithPrincipal which uses XMLHttpRequest so
+    // no executable code will run and doron says that you really can't get to
+    // the schema contents from JS.
+    nsCOMPtr<nsIScriptSecurityManager> secMan =
+      do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
+    NS_ENSURE_STATE(secMan);
+    nsCOMPtr<nsIPrincipal> principal;
+    rv = secMan->GetSystemPrincipal(getter_AddRefs(principal));
+    NS_ENSURE_SUCCESS(rv, rv);
+
     for (PRInt32 i=0; i<mSchemaTotal; ++i) {
       rv = NS_OK;
       nsCAutoString uriSpec;
@@ -850,7 +863,8 @@ nsXFormsModelElement::InitializeInstances()
           }
         } else {
           newURI->GetSpec(uriSpec);
-          rv = mSchemas->LoadAsync(NS_ConvertUTF8toUTF16(uriSpec), this);
+          rv = mSchemas->LoadAsyncWithPrincipal(NS_ConvertUTF8toUTF16(uriSpec),
+                                                this, principal);
         }
       }
       if (NS_FAILED(rv)) {