Attachment #625950 for bug #754202

Attachment #625950: Part 2 - Pull object principals directly off the compartment, and assert that behavior doesn't change. v2 for bug #754202

View | Details | Raw Unified | Return to bug 754202
Collapse All | Expand All





    ObjectPrincipalFinder(JSObject *obj);
    
    // Decides, based on CSP, whether or not eval() and stuff can be executed.
    static JSBool
    ContentSecurityPolicyPermitsJSAction(JSContext *cx);

    // Returns null if a principal cannot be found; generally callers
    // should error out at that point.
    static nsIPrincipal* doGetObjectPrincipal(JSObject *obj);
    doGetObjectPrincipal(JSObject *obj
#ifdef DEBUG
    static nsIPrincipal*
    old_doGetObjectPrincipal(JSObject *obj, bool aAllowShortCircuit = true);
#endif
                         );

    // Returns null if a principal cannot be found.  Note that rv can be NS_OK
    // when this happens -- this means that there was no JS running.
    nsIPrincipal*
    doGetSubjectPrincipal(nsresult* rv);
    
    nsresult
    CheckPropertyAccessImpl(PRUint32 aAction,





    if (!*result)
        return NS_ERROR_FAILURE;
    NS_ADDREF(*result);
    return NS_OK;
}

// static
nsIPrincipal*
nsScriptSecurityManager::doGetObjectPrincipal(JSObject *aObj)
{
    JSCompartment *compartment = js::GetObjectCompartment(aObj);
    JSPrincipals *principals = JS_GetCompartmentPrincipals(compartment);
    nsIPrincipal *principal = nsJSPrincipals::get(principals);

    // We leave the old code in for a little while to make sure that pulling
    // object principals directly off the compartment always gives an equivalent
    // result (from a security perspective).
#ifdef DEBUG
    nsIPrincipal *old = old_doGetObjectPrincipal(aObj);
    MOZ_ASSERT(NS_SUCCEEDED(CheckSameOriginPrincipal(principal, old)));
#endif

    return principal;
}

#ifdef DEBUG
// static
nsIPrincipal*
nsScriptSecurityManager::old_doGetObjectPrincipal(JSObject *aObj,
                                                  bool aAllowShortCircuit)
{
    NS_ASSERTION(aObj, "Bad call to doGetObjectPrincipal()!");
    nsIPrincipal* result = nsnull;

#ifdef DEBUG
    JSObject* origObj = aObj;
#endif
    
    js::Class *jsClass = js::GetObjectClass(aObj);

    // A common case seen in this code is that we enter this function
    // with aObj being a Function object, whose parent is a Call
    // object. Neither of those have object principals, so we can skip
    // those objects here before we enter the below loop. That way we
    // avoid wasting time checking properties of their classes etc in
    // the loop.

    }

    do {
        // Note: jsClass is set before this loop, and also at the
        // *end* of this loop.
        
        if (IS_WRAPPER_CLASS(jsClass)) {
            result = sXPConnect->GetPrincipal(aObj,
                                              aAllowShortCircuit);
                                              aAllowShortCircuit
#else
                                              true
#endif
                                              );
            if (result) {
                break;
            }
        } else {
            nsISupports *priv;
            if (!(~jsClass->flags & (JSCLASS_HAS_PRIVATE |
                                     JSCLASS_PRIVATE_IS_NSISUPPORTS))) {
                priv = (nsISupports *) js::GetObjectPrivate(aObj);
            } else if ((jsClass->flags & JSCLASS_IS_DOMJSCLASS) &&
                       DOMJSClass::FromJSClass(jsClass)->mDOMObjectIsISupports) {
                priv = UnwrapDOMObject<nsISupports>(aObj, jsClass);
            } else {
                priv = nsnull;
            }

#ifdef DEBUG
            if (aAllowShortCircuit) {
                nsCOMPtr<nsIXPConnectWrappedNative> xpcWrapper =
                    do_QueryInterface(priv);

                NS_ASSERTION(!xpcWrapper ||
                             !strcmp(jsClass->name, "XPCNativeWrapper"),
                             "Uh, an nsIXPConnectWrappedNative with the "
                             "wrong JSClass or getObjectOps hooks!");
            }
#endif

            nsCOMPtr<nsIScriptObjectPrincipal> objPrin =
                do_QueryInterface(priv);

            if (objPrin) {
                result = objPrin->GetPrincipal();

                if (result) {

        aObj = js::GetObjectParentMaybeScope(aObj);

        if (!aObj)
            break;

        jsClass = js::GetObjectClass(aObj);
    } while (1);

#ifdef DEBUG
    if (aAllowShortCircuit) {
        nsIPrincipal *principal = old_doGetObjectPrincipal(origObj, false);

        // Because of inner window reuse, we can have objects with one principal
        // living in a scope with a different (but same-origin) principal. So
        // just check same-origin here.
        NS_ASSERTION(NS_SUCCEEDED(CheckSameOriginPrincipal(result, principal)),
                     "Principal mismatch.  Not good");
    }
#endif

    return result;
}
#endif /* DEBUG */

///////////////// Capabilities API /////////////////////
NS_IMETHODIMP
nsScriptSecurityManager::IsCapabilityEnabled(const char *capability,
                                             bool *result)
{
    nsresult rv;
    JSStackFrame *fp = nsnull;

Return to bug 754202