Attachment #600577 for bug #341604

Attachment #600577: WIP - iframe sandbox v5 for bug #341604

View | Details | Raw Unified | Return to bug 341604
Collapse All | Expand All





   * from the document it comes from.
   */
  static nsresult URIInheritsSecurityContext(nsIURI *aURI, bool *aResult);

  /**
   * Set the given principal as the owner of the given channel, if
   * needed.  aURI must be the URI of aChannel.  aPrincipal may be
   * null.  If aSetUpForAboutBlank is true, then about:blank will get
   * the principal set up on it. If aForceOwner is true, the owner
   * will be set on the channel, even if the principal can be determined
   * from the channel.
   * The return value is whether the principal was set up as the owner
   * of the channel.
   */
  static bool SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
                                nsIChannel* aChannel,
                                nsIURI* aURI,
                                bool aSetUpForAboutBlank,
                                bool aForceOwner = false);

  static nsresult Btoa(const nsAString& aBinaryData,
                       nsAString& aAsciiBase64String);

  static nsresult Atob(const nsAString& aAsciiString,
                       nsAString& aBinaryData);

  /**
   * Returns whether the input element passed in parameter has the autocomplete
   * functionality enabled. It is taking into account the form owner.
   * NOTE: the caller has to make sure autocomplete makes sense for the
   * element's type.
   *
   * @param aInput the input element to check. NOTE: aInput can't be null.
   * @return whether the input element has autocomplete enabled.
   */
  static bool IsAutocompleteEnabled(nsIDOMHTMLInputElement* aInput);


   * comma-separated list of URIs.  Return true if the given URI's prepath is
   * in the list, and false otherwise.
   *
   * Comparisons are case-insensitive, and whitespace between elements of the
   * comma-separated list is ignored.
   */
  static bool URIIsChromeOrInPref(nsIURI *aURI, const char *aPref);

  /**
   * A helper function that parses a sandbox attribute (of an <iframe> or
   * a CSP directive) and converts it to the set of flags used internally.
   *
   * @param aAttribute 	the value of the sandbox attribute
   * @return 			the set of flags
   */
  static PRUint32 ParseSandboxAttributeToFlags(const nsAString&
                                                 sandboxAttr);

private:
  static bool InitializeEventTable();

  static nsresult EnsureStringBundle(PropertiesFile aFile);

  static nsIDOMScriptObjectFactory *GetDOMScriptObjectFactory();

  static nsresult HoldScriptObject(PRUint32 aLangID, void* aObject);






namespace dom {
class Link;
class Element;
} // namespace dom
} // namespace mozilla

#define NS_IDOCUMENT_IID \
{ 0x57fe44ae, 0x6656, 0x44b8, \
  { 0x8d, 0xc0, 0xfc, 0xa7, 0x43, 0x28, 0xbe, 0x86 } }


// Flag for AddStyleSheet().
#define NS_STYLESHEET_FROM_CATALOG                (1 << 0)

// Enum for requesting a particular type of document when creating a doc
enum DocumentFlavor {
  DocumentFlavorLegacyGuess, // compat with old code until made HTML5-compliant

   * callers are expected to take action as needed if they want this
   * change to actually change anything immediately.
   * @see nsBidiUtils.h
   */
  void SetBidiOptions(PRUint32 aBidiOptions)
  {
    mBidiOptions = aBidiOptions;
  }

  /**
   * Get the sandbox flags for this document.
   * @see nsIDocShell.idl for the possible flags
   */
  PRUint32 SandboxFlags() const
  {
    return mSandboxFlags;
  }

  /**
   * Access HTTP header data (this may also get set from other
   * sources, like HTML META tags).
   */
  virtual void GetHeaderData(nsIAtom* aHeaderField, nsAString& aData) const = 0;
  virtual void SetHeaderData(nsIAtom* aheaderField, const nsAString& aData) = 0;

  /**

  // If mIsStaticDocument is true, mOriginalDocument points to the original
  // document.
  nsCOMPtr<nsIDocument> mOriginalDocument;

  // The bidi options for this document.  What this bitfield means is
  // defined in nsBidiUtils.h
  PRUint32 mBidiOptions;

  // The sandbox flags on the document. These reflect the value of the sandbox attribute of the
  // associated IFRAME or CSP-protectable content, if existent. These are set at load time and
  // are immutable - see nsIDocShell.idl for the possible flags.
  PRUint32 mSandboxFlags;

  nsCString mContentLanguage;
private:
  nsCString mContentType;
protected:

  // The document's security info
  nsCOMPtr<nsISupports> mSecurityInfo;






    nsresult rv = CallGetService(kParserServiceCID, &sParserService);
    if (NS_FAILED(rv)) {
      sParserService = nsnull;
    }
  }

  return sParserService;
}
/**
 * A helper function that parses a sandbox attribute (of an <iframe> or
 * a CSP directive) and converts it to the set of flags used internally.
 *
 * @param aAttribute    the value of the sandbox attribute
 * @return              the set of flags
 */
PRUint32
nsContentUtils::ParseSandboxAttributeToFlags(const nsAString& sandboxAttrValue)
{
  // If there's a sandbox attribute at all (and there is if this is being
  // called), start off by setting all the restriction flags.
  PRUint32 out = nsIDocShell::SANDBOXED_NAVIGATION |
    nsIDocShell::SANDBOXED_TOPLEVEL_NAVIGATION |
    nsIDocShell::SANDBOXED_PLUGINS | nsIDocShell::SANDBOXED_ORIGIN |
    nsIDocShell::SANDBOXED_FORMS | nsIDocShell::SANDBOXED_SCRIPTS |
    nsIDocShell::SANDBOXED_AUTOMATIC_FEATURES;

  if (!sandboxAttrValue.IsEmpty()) {
    // The separator optional flag is used because the HTML5 spec says any
    // whitespace is ok as a separator, which is what this does.
    HTMLSplitOnSpacesTokenizer tokenizer(sandboxAttrValue, ' ',
      nsCharSeparatedTokenizerTemplate<nsContentUtils::IsHTMLWhitespace>::SEPARATOR_OPTIONAL);

    while (tokenizer.hasMoreTokens()) {
      nsDependentSubstring token = tokenizer.nextToken();

      if (token.LowerCaseEqualsLiteral("allow-scripts")) {
        out &= ~nsIDocShell::SANDBOXED_SCRIPTS;
      } else if (token.LowerCaseEqualsLiteral("allow-same-origin")) {
        out &= ~nsIDocShell::SANDBOXED_ORIGIN;
      } else if (token.LowerCaseEqualsLiteral("allow-forms")) {
        out &= ~nsIDocShell::SANDBOXED_FORMS;
      } else if (token.LowerCaseEqualsLiteral("allow-scripts")) {
        // allow-scripts removes both SANDBOXED_SCRIPTS and
        // SANDBOXED_AUTOMATIC_FEATURES.
        out &= ~nsIDocShell::SANDBOXED_SCRIPTS;
        out &= ~nsIDocShell::SANDBOXED_AUTOMATIC_FEATURES;
      } else if (token.LowerCaseEqualsLiteral("allow-top-navigation")) {
        out &= ~nsIDocShell::SANDBOXED_TOPLEVEL_NAVIGATION;
      }
    }
  }

  return out;
}

#ifdef MOZ_XTF
nsIXTFService*
nsContentUtils::GetXTFService()
{
  if (!sXTFService) {
    nsresult rv = CallGetService(kXTFServiceCID, &sXTFService);
    if (NS_FAILED(rv)) {

                             aResult);
}

// static
bool
nsContentUtils::SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
                                  nsIChannel* aChannel,
                                  nsIURI* aURI,
                                  bool aSetUpForAboutBlank,
                                  bool aForceOwner)
{
  //
  // Set the owner of the channel, but only for channels that can't
  // provide their own security context.
  //
  // XXX: It seems wrong that the owner is ignored - even if one is
  //      supplied) unless the URI is javascript or data or about:blank.
  // XXX: If this is ever changed, check all callers for what owners

  //      comments in nsDocShell::LoadURI where we fall back on
  //      inheriting the owner if called from chrome.  That would be
  //      very wrong if this code changed anything but channels that
  //      can't provide their own security context!
  //
  //      (Currently chrome URIs set the owner when they are created!
  //      So setting a NULL owner would be bad!)
  //
  // If aForceOwner is true, the owner will be set, even for a channel that
  // can provide its own security context. This is used for the HTML5 IFRAME
  // sandbox attribute, so we can force the channel (and its document) to
  // explicitly have a null principal.
  bool inherit;
  // We expect URIInheritsSecurityContext to return success for an
  // about:blank URI, so don't call NS_IsAboutBlank() if this call fails.
  // This condition needs to match the one in nsDocShell::InternalLoad where
  // we're checking for things that will use the owner.
  if (aForceOwner || ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
      (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))))) {
    aChannel->SetOwner(aLoadingPrincipal);
    return true;
  }

  //
  // file: uri special-casing
  //
  // If this is a file: load opened from another file: then it may need





    FindCharInReadable(';', semicolon, end);
    SetContentTypeInternal(Substring(start, semicolon));
  }

  RetrieveRelevantHeaders(aChannel);

  mChannel = aChannel;

  // If this document is being loaded by a docshell, copy its sandbox flags
  // to the document. These are immutable after being set here.
  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(aContainer);

  if (docShell) {
    nsresult rv = docShell->GetSandboxFlags(&mSandboxFlags);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  nsresult rv = InitCSP();
  NS_ENSURE_SUCCESS(rv, rv);

  return NS_OK;
}

nsresult
nsDocument::InitCSP()





#include "mozilla/GuardObjects.h"
#include "mozilla/Preferences.h"
#include "mozilla/unused.h"
#include "mozilla/dom/Element.h"
#include "mozilla/layout/RenderFrameParent.h"

#include "jsapi.h"

#include "nsHTMLIFrameElement.h"

using namespace mozilla;
using namespace mozilla::dom;
using namespace mozilla::layers;
using namespace mozilla::layout;
typedef FrameMetrics::ViewID ViewID;

class nsAsyncDocShellDestroyer : public nsRunnable
{

  // Just to be safe, recheck uri.
  rv = CheckURILoad(mURIToLoad);
  NS_ENSURE_SUCCESS(rv, rv);

  nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
  mDocShell->CreateLoadInfo(getter_AddRefs(loadInfo));
  NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);

  // Is this an <iframe> with a sandbox attribute or a parent which is
  // sandboxed ?
  nsHTMLIFrameElement * iframe =
    nsHTMLIFrameElement::FromContent(mOwnerContent);

  PRUint32 sandboxFlags = 0;

  if (iframe) {
    sandboxFlags = iframe->GetSandboxFlags();

    PRUint32 parentSandboxFlags = 0;

    // Get the parent's sandbox flags, they're needed to determine if the
    // frame being loaded needs to be sandboxed.
    nsCOMPtr<nsIDocShellTreeItem> parentDocShellItem;
    nsCOMPtr<nsIDocShellTreeItem> curDocShellItem = do_QueryInterface(mDocShell);

    if (NS_SUCCEEDED(curDocShellItem->GetParent(getter_AddRefs(parentDocShellItem)))) {
      nsCOMPtr<nsIDocument> parentDoc = do_GetInterface(parentDocShellItem);

      if (parentDoc) {
        parentSandboxFlags = parentDoc->SandboxFlags();
      }
    }

    if (sandboxFlags || parentSandboxFlags) {
      if (parentSandboxFlags) {
        // The child can only add restrictions, not remove them.
        sandboxFlags |= parentSandboxFlags;
      }

      mDocShell->SetSandboxFlags(sandboxFlags);

      // Set up the actual sandboxing for scripts and plugins as specified.
      if (sandboxFlags & nsIDocShell::SANDBOXED_SCRIPTS) {
        mDocShell->SetAllowJavascript(false);
      }

      if (sandboxFlags & nsIDocShell::SANDBOXED_PLUGINS) {
        mDocShell->SetAllowPlugins(false);
      }
    }
  }

  // If this is an <iframe> and it's sandboxed with respect to origin
  // we will set it up with a null principal later in nsDocShell::DoURILoad.
  // We do it there to correctly sandbox content that was loaded into
  // the iframe via other methods than the src attribute.
  // We'll use our principal, not that of the document loaded inside us.  This
  // is very important; needed to prevent XSS attacks on documents loaded in
  // subframes!
  loadInfo->SetOwner(mOwnerContent->NodePrincipal());

  nsCOMPtr<nsIURI> referrer;
  rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
  NS_ENSURE_SUCCESS(rv, rv);





GK_ATOM(address, "address")
GK_ATOM(after, "after")
GK_ATOM(after_end, "after_end")
GK_ATOM(after_start, "after_start")
GK_ATOM(align, "align")
GK_ATOM(alink, "alink")
GK_ATOM(all, "all")
GK_ATOM(allowevents, "allowevents")
GK_ATOM(allowforms, "allow-forms")
GK_ATOM(allownegativeassertions, "allownegativeassertions")
GK_ATOM(allowsameorigin, "allow-same-origin")
GK_ATOM(allowscripts, "allow-scripts")
GK_ATOM(allowtopnavigation, "allow-top-navigation")
GK_ATOM(allowuntrusted, "allowuntrusted")
GK_ATOM(alt, "alt")
GK_ATOM(alternate, "alternate")
GK_ATOM(always, "always")
GK_ATOM(ancestor, "ancestor")
GK_ATOM(ancestorOrSelf, "ancestor-or-self")
GK_ATOM(_and, "and")
GK_ATOM(any, "any")

GK_ATOM(rp, "rp")
GK_ATOM(rt, "rt")
GK_ATOM(rtl, "rtl")
GK_ATOM(ruby, "ruby")
GK_ATOM(rule, "rule")
GK_ATOM(rules, "rules")
GK_ATOM(s, "s")
GK_ATOM(samp, "samp")
GK_ATOM(sandbox, "sandbox")
GK_ATOM(sbattr, "sbattr")
GK_ATOM(scale, "scale")
GK_ATOM(scan, "scan")
GK_ATOM(scheme, "scheme")
GK_ATOM(scope, "scope")
GK_ATOM(scoped, "scoped")
GK_ATOM(screen, "screen")
GK_ATOM(screenX, "screenX")





    return DoReset();
  }

  if (NS_FORM_SUBMIT == aMessage) {
    // Don't submit if we're not in a document.
    if (!doc) {
      return NS_OK;
    }
    // Don't submit if we're in a sandboxed frame and form submit
    // is disabled.
    PRUint32 sandboxFlags = doc->SandboxFlags();

    if (!(sandboxFlags & nsIDocShell::SANDBOXED_FORMS)) {
      return DoSubmit(aEvent);
    }

	return NS_OK;
  }

  MOZ_ASSERT(false);
  return NS_OK;
}

nsresult
nsHTMLFormElement::DoReset()





 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "mozilla/Util.h"

#include "nsIDOMHTMLIFrameElement.h"
#include "nsHTMLIFrameElement.h"
#include "nsIDOMDocument.h"
#include "nsIDOMGetSVGDocument.h"
#include "nsIDOMSVGDocument.h"
#include "nsGkAtoms.h"
#include "nsIDocument.h"
#include "nsMappedAttributes.h"
#include "nsDOMError.h"
#include "nsRuleData.h"
#include "nsStyleConsts.h"

using namespace mozilla;
using namespace mozilla::dom;

class nsHTMLIFrameElement : public nsGenericHTMLFrameElement
                          , public nsIDOMHTMLIFrameElement
                          , public nsIDOMGetSVGDocument
{
public:
  nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                      mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
  virtual ~nsHTMLIFrameElement();

  // nsISupports
  NS_DECL_ISUPPORTS_INHERITED

  // nsIDOMNode
  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFrameElement::)

  // nsIDOMElement
  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFrameElement::)

  // nsIDOMHTMLElement
  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFrameElement::)

  // nsIDOMHTMLIFrameElement
  NS_DECL_NSIDOMHTMLIFRAMEELEMENT

  // nsIDOMGetSVGDocument
  NS_DECL_NSIDOMGETSVGDOCUMENT

  // nsIContent
  virtual bool ParseAttribute(PRInt32 aNamespaceID,
                                nsIAtom* aAttribute,
                                const nsAString& aValue,
                                nsAttrValue& aResult);
  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
  virtual nsXPCClassInfo* GetClassInfo();
};


NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(IFrame)


nsHTMLIFrameElement::nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                                         FromParser aFromParser)
  : nsGenericHTMLFrameElement(aNodeInfo, aFromParser)
{
}

nsHTMLIFrameElement::~nsHTMLIFrameElement()
{
  if (mSandboxTokenList)
    mSandboxTokenList->DropReference();
}


NS_IMPL_ADDREF_INHERITED(nsHTMLIFrameElement,nsGenericElement)
NS_IMPL_RELEASE_INHERITED(nsHTMLIFrameElement,nsGenericElement)

DOMCI_NODE_DATA(HTMLIFrameElement, nsHTMLIFrameElement)


}

NS_IMETHODIMP
nsHTMLIFrameElement::GetSVGDocument(nsIDOMDocument **aResult)
{
  return GetContentDocument(aResult);
}

NS_IMETHODIMP
nsHTMLIFrameElement::GetSandbox(nsIDOMDOMSettableTokenList** aSandbox)
{
  if (!mSandboxTokenList) {
    mSandboxTokenList = new nsDOMSettableTokenList(this, nsGkAtoms::sandbox);
  }

  NS_ADDREF(*aSandbox = mSandboxTokenList);

  return NS_OK;
}

bool
nsHTMLIFrameElement::ParseAttribute(PRInt32 aNamespaceID,
                                    nsIAtom* aAttribute,
                                    const nsAString& aValue,
                                    nsAttrValue& aResult)
{
  if (aNamespaceID == kNameSpaceID_None) {
    if (aAttribute == nsGkAtoms::marginwidth) {

      return ParseFrameborderValue(aValue, aResult);
    }
    if (aAttribute == nsGkAtoms::scrolling) {
      return ParseScrollingValue(aValue, aResult);
    }
    if (aAttribute == nsGkAtoms::align) {
      return ParseAlignValue(aValue, aResult);
    }
    if (aAttribute == nsGkAtoms::sandbox) {
      // The sandbox attribute needs to be parsed as an atom array so
      // it can be exposed as a DOMSettableTokenList.
      aResult.ParseAtomArray(aValue);
      return true;
    }
  }

  return nsGenericHTMLFrameElement::ParseAttribute(aNamespaceID, aAttribute,
                                                   aValue, aResult);
}

static void
MapAttributesIntoRule(const nsMappedAttributes* aAttributes,



nsMapRuleToAttributesFunc
nsHTMLIFrameElement::GetAttributeMappingFunction() const
{
  return &MapAttributesIntoRule;
}

nsresult
nsHTMLIFrameElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                    const nsAttrValue* aValue,
                                    bool aNotify)
{
  if (aName == nsGkAtoms::sandbox && aNameSpaceID == kNameSpaceID_None) {
    // Parse the new value of the sandbox attribute, and if we have a docshell
    // set its sandbox flags appropriately.
    if (mFrameLoader) {
      nsCOMPtr<nsIDocShell> docshell = mFrameLoader->GetExistingDocShell();

      if (docshell) {
        PRUint32 newFlags = 0;
        // If a NULL aValue is passed in, we want to clear the sandbox flags
        // which we will do by setting them to 0.
        if (aValue) {
          newFlags = nsContentUtils::ParseSandboxAttributeToFlags(
            aValue->GetStringValue());
        }
        docshell->SetSandboxFlags(newFlags);
      }
    }
  }
  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue,
                                            aNotify);

}

-      Line
+  Link Here
-      Line 0
+  Link Here
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#include "mozilla/Util.h"
+#include "nsIDOMHTMLIFrameElement.h"
+#include "nsGenericHTMLElement.h"
+#include "nsGenericHTMLFrameElement.h"
+#include "nsIDOMDocument.h"
+#include "nsIDOMGetSVGDocument.h"
+#include "nsIDOMSVGDocument.h"
+#include "nsGkAtoms.h"
+#include "nsIDocument.h"
+#include "nsMappedAttributes.h"
+#include "nsDOMError.h"
+#include "nsRuleData.h"
+#include "nsStyleConsts.h"
+#include "nsDOMSettableTokenList.h"
+#include "nsContentUtils.h"
+class nsHTMLIFrameElement : public nsGenericHTMLFrameElement
+                          , public nsIDOMHTMLIFrameElement
+                          , public nsIDOMGetSVGDocument
+{
+public:
+  nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
+                      mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
+  virtual ~nsHTMLIFrameElement();
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE(nsGenericHTMLFrameElement::)
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFrameElement::)
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFrameElement::)
+  // nsIDOMHTMLIFrameElement
+  NS_DECL_NSIDOMHTMLIFRAMEELEMENT
+  // nsIDOMGetSVGDocument
+  NS_DECL_NSIDOMGETSVGDOCUMENT
+  // nsIContent
+  virtual bool ParseAttribute(PRInt32 aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult);
+  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
+  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+  virtual nsXPCClassInfo* GetClassInfo();
+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
+                                  const nsAttrValue* aValue,
+                                  bool aNotify);
+  PRUint32 GetSandboxFlags() {
+    nsAutoString sandboxAttr;
+    if (GetAttr(kNameSpaceID_None, nsGkAtoms::sandbox, sandboxAttr)) {
+      return nsContentUtils::ParseSandboxAttributeToFlags(sandboxAttr);
+    }
+    // No sandbox attribute, no sandbox flags.
+    return 0;
+  }
+  static nsHTMLIFrameElement* FromContent(nsIContent *aContent)
+  {
+    if (aContent->IsHTML(nsGkAtoms::iframe))
+      return static_cast<nsHTMLIFrameElement*>(aContent);
+    return nsnull;
+  }
+protected:
+  nsRefPtr<nsDOMSettableTokenList>  mSandboxTokenList;
+};





{
  aCookie.Truncate(); // clear current cookie in case service fails;
                      // no cookie isn't an error condition.

  if (mDisableCookieAccess) {
    return NS_OK;
  }

  // If the document's sandboxed origin flag is set, access to read cookies
  // is prohibited.
  if (mSandboxFlags & nsIDocShell::SANDBOXED_ORIGIN)
    return NS_ERROR_DOM_SECURITY_ERR;

  // not having a cookie service isn't an error
  nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
  if (service) {
    // Get a URI from the document principal. We use the original
    // codebase in case the codebase was changed by SetDomain
    nsCOMPtr<nsIURI> codebaseURI;
    NodePrincipal()->GetURI(getter_AddRefs(codebaseURI));



NS_IMETHODIMP
nsHTMLDocument::SetCookie(const nsAString& aCookie)
{
  if (mDisableCookieAccess) {
    return NS_OK;
  }

  // If the document's sandboxed origin flag is set, access to write cookies
  // is prohibited.
  if (mSandboxFlags & nsIDocShell::SANDBOXED_ORIGIN)
    return NS_ERROR_DOM_SECURITY_ERR;

  // not having a cookie service isn't an error
  nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
  if (service && mDocumentURI) {
    nsCOMPtr<nsIPrompt> prompt;
    nsCOMPtr<nsPIDOMWindow> window = GetWindow();
    if (window) {
      window->GetPrompter(getter_AddRefs(prompt));
    }





    mBusyFlags(BUSY_FLAGS_NONE),
    mAppType(nsIDocShell::APP_TYPE_UNKNOWN),
    mLoadType(0),
    mMarginWidth(-1),
    mMarginHeight(-1),
    mItemType(typeContent),
    mPreviousTransIndex(-1),
    mLoadedTransIndex(-1),
    mSandboxFlags(0),
    mCreated(false),
    mAllowSubframes(true),
    mAllowPlugins(true),
    mAllowJavascript(true),
    mAllowMetaRedirects(true),
    mAllowImages(true),
    mAllowDNSPrefetch(true),
    mAllowWindowControl(true),

            foundItem = nsnull;
        }

        if (foundItem) {
            // We return foundItem here even if it's not an active
            // item since all the names we've dealt with so far are
            // special cases that we won't bother looking for further.

            // If our document is sandboxed, we need to do some extra checks.
            PRUint32 sandboxFlags = 0;

            nsCOMPtr<nsIDocument> doc = do_GetInterface(aOriginalRequestor);

            if (doc) {
              sandboxFlags = doc->SandboxFlags();
            }

            if (sandboxFlags) {
                nsCOMPtr<nsIDocShellTreeItem> root;
                GetSameTypeRootTreeItem(getter_AddRefs(root));

                // Is the found item not a top level browsing context and not ourself ?
                nsCOMPtr<nsIDocShellTreeItem> selfAsItem = static_cast<nsIDocShellTreeItem *>(this);
                if (foundItem != root && foundItem != selfAsItem) {
                    // Are we an ancestor of the foundItem ?
                    bool isAncestor = false;

                    nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
                    GetSameTypeParent(getter_AddRefs(parentAsItem));

                    while (parentAsItem) {
                        nsCOMPtr<nsIDocShellTreeItem> tmp;
                        parentAsItem->GetParent(getter_AddRefs(tmp));

                        if (tmp && tmp == selfAsItem) {
                            isAncestor = true;
                            break;
                        }
                        parentAsItem = tmp;
                    }

                    if (!isAncestor) {
                        // No, we are not an ancestor and our document is
                        // sandboxed, we can't allow this.
                        foundItem = nsnull;
                    }
                } else {
                    // Top level browsing context - is it an ancestor of ours ?
                    nsCOMPtr<nsIDocShellTreeItem> tmp;
                    GetSameTypeParent(getter_AddRefs(tmp));

                    while (tmp) {
                        if (tmp && tmp == foundItem) {
                            // This is an ancestor, and we are sandboxed.
                            // Unless allow-top-navigation is set, we can't allow this.
                            if (sandboxFlags & nsIDocShell::SANDBOXED_TOPLEVEL_NAVIGATION) {
                              foundItem = nsnull;
                            }
                            break;
                        }
                        tmp->GetParent(getter_AddRefs(tmp));
                    }
                }
            }

            foundItem.swap(*_retval);
            return NS_OK;
        }
    }

    // Keep looking
        
    // First we check our name.

NS_IMETHODIMP
nsDocShell::GetIsAppTab(bool *aIsAppTab)
{
  *aIsAppTab = mIsAppTab;
  return NS_OK;
}

NS_IMETHODIMP
nsDocShell::SetSandboxFlags(PRUint32 aSandboxFlags)
{
  mSandboxFlags = aSandboxFlags;
  return NS_OK;
}

NS_IMETHODIMP
nsDocShell::GetSandboxFlags(PRUint32  *aSandboxFlags)
{
  *aSandboxFlags = mSandboxFlags;
  return NS_OK;
}

NS_IMETHODIMP
nsDocShell::SetVisibility(bool aVisibility)
{
    if (!mContentViewer)
        return NS_OK;
    if (aVisibility) {
        mContentViewer->Show();
    }
    else {

        nsCOMPtr<nsIDocShellTreeItem> targetItem;
        FindItemWithName(aWindowTarget, nsnull, this,
                         getter_AddRefs(targetItem));

        nsCOMPtr<nsIDocShell> targetDocShell = do_QueryInterface(targetItem);
        
        bool isNewWindow = false;
        if (!targetDocShell) {
            // If the docshell's document is sandboxed and was trying to
            // navigate/load a frame it wasn't allowed to access, the
            // FindItemWithName above will have returned null for the target
            // item - we don't want to actually open a new window in this case
            // though. Check if we are sandboxed and bail out here if so.
            NS_ENSURE_TRUE(mContentViewer, NS_ERROR_FAILURE);
            nsIDocument* doc = mContentViewer->GetDocument();
            PRUint32 sandboxFlags = 0;
            sandboxFlags = doc->SandboxFlags();
            if (sandboxFlags & nsIDocShell::SANDBOXED_NAVIGATION) {
              return NS_ERROR_FAILURE;
            }

            nsCOMPtr<nsIDOMWindow> win =
                do_GetInterface(GetAsSupports(this));
            NS_ENSURE_TRUE(win, NS_ERROR_NOT_AVAILABLE);

            nsDependentString name(aWindowTarget);
            nsCOMPtr<nsIDOMWindow> newWin;
            rv = win->Open(EmptyString(), // URL to load
                           name,          // window name

        }
        // Set the referrer explicitly
        if (aReferrerURI && aSendReferrer) {
            // Referrer is currenly only set for link clicks here.
            httpChannel->SetReferrer(aReferrerURI);
        }
    }

    nsCOMPtr<nsIPrincipal> ownerPrincipal;

    // If the content being loaded should be sandboxed with respect to origin
    // we need to create a new null principal here, and then tell
    // nsContentUtils::SetUpChannelOwner to force it to be set as the
    // channel owner.
    if (mSandboxFlags & nsIDocShell::SANDBOXED_ORIGIN) {
      ownerPrincipal = do_CreateInstance("@mozilla.org/nullprincipal;1");
    } else {
      // Not sandboxed - we allow the content to assume its natural owner.
      ownerPrincipal = do_QueryInterface(aOwner);
    }

    nsContentUtils::SetUpChannelOwner(ownerPrincipal, channel, aURI, true,
                                       (mSandboxFlags &
                                        nsIDocShell::SANDBOXED_ORIGIN));

    nsCOMPtr<nsIScriptChannel> scriptChannel = do_QueryInterface(channel);
    if (scriptChannel) {
        // Allow execution against our context if the principals match
        scriptChannel->
            SetExecutionPolicy(nsIScriptChannel::EXECUTE_NORMAL);
    }






    // Create() is called, the type is not expected to change.
    PRInt32                    mItemType;

    // Index into the SHTransaction list, indicating the previous and current
    // transaction at the time that this DocShell begins to load
    PRInt32                    mPreviousTransIndex;
    PRInt32                    mLoadedTransIndex;

    PRUint32                   mSandboxFlags;

    bool                       mCreated;
    bool                       mAllowSubframes;
    bool                       mAllowPlugins;
    bool                       mAllowJavascript;
    bool                       mAllowMetaRedirects;
    bool                       mAllowImages;
    bool                       mAllowDNSPrefetch;
    bool                       mAllowWindowControl;





interface nsISHEntry;
interface nsILayoutHistoryState;
interface nsISecureBrowserUI;
interface nsIDOMStorage;
interface nsIPrincipal;
interface nsIWebBrowserPrint;
interface nsIVariant;

[scriptable, uuid(9b283337-097d-4fa8-a2da-916318eaf828)]
interface nsIDocShell : nsISupports
{
  /**
   * Loads a given URI.  This will give priority to loading the requested URI
   * in the object implementing	this interface.  If it can't be loaded here
   * however, the URL dispatcher will go through its normal process of content
   * loading.
   *

   */
  attribute nsIAtom parentCharset;

  /*
   * In a child docshell, this is the source of parentCharset
   * @see nsIParser
   */
  attribute PRInt32 parentCharsetSource;

  /**
   * The sandbox flags on the docshell. These reflect the value of the sandbox
   * attribute of the associated IFRAME or CSP-protectable content, if
   * existent. See the HTML5 spec for more details.
   * These flags on the docshell reflect the current state of the sandbox
   * attribute, which is modifiable. They are only used when loading new
   * content, sandbox flags are also immutably set on the document when it is
   * loaded.
   * The sandbox flags of a document depend on the sandbox flags on its
   * docshell and of its parent document, if any.
   */
  attribute unsigned long sandboxFlags;

  /**
   * This flag prevents content from navigating browsing contexts other than
   * the sandboxed browsing context itself (or browsing contexts further
   * nested inside it), and the top-level browsing context.
   */
  const unsigned long SANDBOXED_NAVIGATION  = 0x1;

  /**
   * This flag prevents content from navigating their top-level browsing
   * context.
   */
  const unsigned long SANDBOXED_TOPLEVEL_NAVIGATION = 0x2;

  /**
   * This flag prevents content from instantiating plugins, whether using the
   * embed element, the object element, the applet element, or through
   * navigation of a nested browsing context, unless those plugins can be
   * secured.
   */
  const unsigned long SANDBOXED_PLUGINS = 0x4;

  /**
   * This flag forces content into a unique origin, thus preventing it from
   * accessing other content from the same origin.
   * This flag also prevents script from reading from or writing to the
   * document.cookie IDL attribute, and blocks access to localStorage.
   */
  const unsigned long SANDBOXED_ORIGIN = 0x8;

  /**
   * This flag blocks form submission.
   */
  const unsigned long SANDBOXED_FORMS = 0x10;

  /**
   * This flag blocks script execution.
   */
  const unsigned long SANDBOXED_SCRIPTS = 0x20;

  /**
   * This flag blocks features that trigger automatically, such as
   * automatically playing a video or automatically focusing a form control.
   */
  const unsigned long SANDBOXED_AUTOMATIC_FEATURES = 0x40;
};





  if (!mSessionStorage) {
    *aSessionStorage = nsnull;

    nsString documentURI;
    if (mDocument) {
      mDocument->GetDocumentURI(documentURI);
    }

    // If the document has the sandboxed origin flag set
    // don't allow access to localStorage.
    if (mDoc && (mDoc->SandboxFlags() & nsIDocShell::SANDBOXED_ORIGIN)) {
      return NS_ERROR_DOM_SECURITY_ERR;
    }

    nsresult rv = docShell->GetSessionStorageForPrincipal(principal,
                                                          documentURI,
                                                          true,
                                                          getter_AddRefs(mSessionStorage));
    NS_ENSURE_SUCCESS(rv, rv);

#ifdef PR_LOGGING
    if (PR_LOG_TEST(gDOMLeakPRLog, PR_LOG_DEBUG)) {

      do_GetService("@mozilla.org/dom/storagemanager;1", &rv);
    NS_ENSURE_SUCCESS(rv, rv);

    nsString documentURI;
    if (mDocument) {
      mDocument->GetDocumentURI(documentURI);
    }

    // If the document has the sandboxed origin flag set
    // don't allow access to localStorage.
    if (mDoc && (mDoc->SandboxFlags() & nsIDocShell::SANDBOXED_ORIGIN)) {
      return NS_ERROR_DOM_SECURITY_ERR;
    }

    rv = storageManager->GetLocalStorageForPrincipal(principal,
                                                     documentURI,
                                                     getter_AddRefs(mLocalStorage));
    NS_ENSURE_SUCCESS(rv, rv);
  }

  NS_ADDREF(*aLocalStorage = mLocalStorage);
  return NS_OK;





 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "nsIDOMHTMLElement.idl"
#include "nsIDOMDOMSettableTokenList.idl"

/**
 * The nsIDOMHTMLIFrameElement interface is the interface to a [X]HTML
 * iframe element.
 *
 * This interface is trying to follow the DOM Level 2 HTML specification:
 * http://www.w3.org/TR/DOM-Level-2-HTML/
 *
 * with changes from the work-in-progress WHATWG HTML specification:
 * http://www.whatwg.org/specs/web-apps/current-work/
 */

[scriptable, uuid(52f6244b-b1f5-4f4c-8ff3-7e146316f411)]
interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
{
           attribute DOMString        align;
           attribute DOMString        frameBorder;
           attribute DOMString        height;
           attribute DOMString        longDesc;
           attribute DOMString        marginHeight;
           attribute DOMString        marginWidth;
           attribute DOMString        name;
           attribute DOMString        scrolling;
           attribute DOMString        src;
           attribute DOMString        width;
  // Introduced in DOM Level 2:
  readonly attribute nsIDOMDocument   contentDocument;
  readonly attribute nsIDOMWindow     contentWindow;

  readonly attribute nsIDOMDOMSettableTokenList sandbox;

  // Mozilla extensions
  // iframe elements require the mozAllowFullScreen attribute to be present
  // if they're to allow content in the sub document to go into DOM full-screen
  // mode. See https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI
           attribute boolean          mozAllowFullScreen;
};





  }

  if (!newDocShellItem) {
    // We're going to either open up a new window ourselves or ask a
    // nsIWindowProvider for one.  In either case, we'll want to set the right
    // name on it.
    windowNeedsName = true;

    // If the parent trying to open a new window is sandboxed,
    // this is not allowed and we fail here.
    if (aParent) {
      nsCOMPtr<nsIDOMDocument> domdoc;
      aParent->GetDocument(getter_AddRefs(domdoc));
      nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);

      if (doc) {
        PRUint32 sandboxFlags = 0;
        sandboxFlags = doc->SandboxFlags();

        if (sandboxFlags & nsIDocShell::SANDBOXED_NAVIGATION) {
          return NS_ERROR_FAILURE;
        }
      }
    }

    // Now check whether it's ok to ask a window provider for a window.  Don't
    // do it if we're opening a dialog or if our parent is a chrome window or
    // if we're opening something that has modal, dialog, or chrome flags set.
    nsCOMPtr<nsIDOMChromeWindow> chromeWin = do_QueryInterface(aParent);
    if (!aDialog && !chromeWin &&
        !(chromeFlags & (nsIWebBrowserChrome::CHROME_MODAL         |
                         nsIWebBrowserChrome::CHROME_OPENAS_DIALOG | 
                         nsIWebBrowserChrome::CHROME_OPENAS_CHROME))) {

Return to bug 341604