Attachment #633209 for bug #341604

Attachment #633209: iframe sandbox v16 for bug #341604

View | Details | Raw Unified | Return to bug 341604
Collapse All | Expand All





  /**
   * Get the localized string named |aKey| in properties file |aFile|.
   */
  static nsresult GetLocalizedString(PropertiesFile aFile,
                                     const char* aKey,
                                     nsXPIDLString& aResult);

  /**
   * A helper function that parses a sandbox attribute (of an <iframe> or
   * a CSP directive) and converts it to the set of flags used internally.
   *
   * @param aAttribute 	the value of the sandbox attribute
   * @return 			the set of flags
   */
  static PRUint32 ParseSandboxAttributeToFlags(const nsAString&
                                                 aSandboxAttr);


  /**
   * Fill (with the parameters given) the localized string named |aKey| in
   * properties file |aFile|.
   */
private:
  static nsresult FormatLocalizedString(PropertiesFile aFile,
                                        const char* aKey,
                                        const PRUnichar** aParams,
                                        PRUint32 aParamsLength,

   * from the document it comes from.
   */
  static nsresult URIInheritsSecurityContext(nsIURI *aURI, bool *aResult);

  /**
   * Set the given principal as the owner of the given channel, if
   * needed.  aURI must be the URI of aChannel.  aPrincipal may be
   * null.  If aSetUpForAboutBlank is true, then about:blank will get
   * the principal set up on it. If aForceOwner is true, the owner
   * will be set on the channel, even if the principal can be determined
   * from the channel.
   * The return value is whether the principal was set up as the owner
   * of the channel.
   */
  static bool SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
                                nsIChannel* aChannel,
                                nsIURI* aURI,
                                bool aSetUpForAboutBlank,
                                bool aForceOwner = false);

  static nsresult Btoa(const nsAString& aBinaryData,
                       nsAString& aAsciiBase64String);

  static nsresult Atob(const nsAString& aAsciiString,
                       nsAString& aBinaryData);

  /** If aJSArray is a Javascript array, this method iterates over its
   *  elements and appends values to aRetVal as nsIAtoms.
   *  @throw NS_ERROR_ILLEGAL_VALUE if aJSArray isn't a JS array.
   */ 
  static nsresult JSArrayToAtomArray(JSContext* aCx, const JS::Value& aJSArray,
                                     nsCOMArray<nsIAtom>& aRetVal);

  /**
   * Returns whether the input element passed in parameter has the autocomplete
   * functionality enabled. It is taking into account the form owner.
   * NOTE: the caller has to make sure autocomplete makes sense for the
   * element's type.
   *
   * @param aInput the input element to check. NOTE: aInput can't be null.
   * @return whether the input element has autocomplete enabled.
   */
  static bool IsAutocompleteEnabled(nsIDOMHTMLInputElement* aInput);







namespace dom {
class Link;
class Element;
} // namespace dom
} // namespace mozilla

#define NS_IDOCUMENT_IID \
{ 0x57fe44ae, 0x6656, 0x44b8, \
  { 0x8d, 0xc0, 0xfc, 0xa7, 0x43, 0x28, 0xbe, 0x86 } }

// Flag for AddStyleSheet().
#define NS_STYLESHEET_FROM_CATALOG                (1 << 0)

// Enum for requesting a particular type of document when creating a doc
enum DocumentFlavor {
  DocumentFlavorLegacyGuess, // compat with old code until made HTML5-compliant
  DocumentFlavorHTML, // HTMLDocument with HTMLness bit set to true

   * callers are expected to take action as needed if they want this
   * change to actually change anything immediately.
   * @see nsBidiUtils.h
   */
  void SetBidiOptions(PRUint32 aBidiOptions)
  {
    mBidiOptions = aBidiOptions;
  }

  /**
   * Get the sandbox flags for this document.
   * @see nsSandboxFlags.h for the possible flags
   */
  PRUint32 SandboxFlags() const
  {
    return mSandboxFlags;
  }

  /**
   * Access HTTP header data (this may also get set from other
   * sources, like HTML META tags).
   */
  virtual void GetHeaderData(nsIAtom* aHeaderField, nsAString& aData) const = 0;
  virtual void SetHeaderData(nsIAtom* aheaderField, const nsAString& aData) = 0;

  /**

  // If mIsStaticDocument is true, mOriginalDocument points to the original
  // document.
  nsCOMPtr<nsIDocument> mOriginalDocument;

  // The bidi options for this document.  What this bitfield means is
  // defined in nsBidiUtils.h
  PRUint32 mBidiOptions;

  // The sandbox flags on the document. These reflect the value of the sandbox attribute of the
  // associated IFRAME or CSP-protectable content, if existent. These are set at load time and
  // are immutable - see nsSandboxFlags.h for the possible flags.
  PRUint32 mSandboxFlags;

  nsCString mContentLanguage;
private:
  nsCString mContentType;
protected:

  // The document's security info
  nsCOMPtr<nsISupports> mSecurityInfo;







#include "nsWrapperCacheInlines.h"
#include "nsIDOMDocumentType.h"
#include "nsCharSeparatedTokenizer.h"

#include "nsICharsetDetector.h"
#include "nsICharsetDetectionObserver.h"
#include "nsIPlatformCharset.h"
#include "nsSandboxFlags.h"

extern "C" int MOZ_XMLTranslateEntity(const char* ptr, const char* end,
                                      const char** next, PRUnichar* result);
extern "C" int MOZ_XMLCheckQName(const char* ptr, const char* end,
                                 int ns_aware, const char** colon);

using namespace mozilla::dom;
using namespace mozilla::layers;

    nsresult rv = CallGetService(kParserServiceCID, &sParserService);
    if (NS_FAILED(rv)) {
      sParserService = nsnull;
    }
  }

  return sParserService;
}
/**
 * A helper function that parses a sandbox attribute (of an <iframe> or
 * a CSP directive) and converts it to the set of flags used internally.
 *
 * @param aAttribute    the value of the sandbox attribute
 * @return              the set of flags
 */
PRUint32
nsContentUtils::ParseSandboxAttributeToFlags(const nsAString& aSandboxAttrValue)
{
  // If there's a sandbox attribute at all (and there is if this is being
  // called), start off by setting all the restriction flags.
  PRUint32 out = SANDBOXED_NAVIGATION |
    SANDBOXED_TOPLEVEL_NAVIGATION |
    SANDBOXED_PLUGINS | SANDBOXED_ORIGIN |
    SANDBOXED_FORMS | SANDBOXED_SCRIPTS |
    SANDBOXED_AUTOMATIC_FEATURES;

  if (!aSandboxAttrValue.IsEmpty()) {
    // The separator optional flag is used because the HTML5 spec says any
    // whitespace is ok as a separator, which is what this does.
    HTMLSplitOnSpacesTokenizer tokenizer(aSandboxAttrValue, ' ',
      nsCharSeparatedTokenizerTemplate<nsContentUtils::IsHTMLWhitespace>::SEPARATOR_OPTIONAL);

    while (tokenizer.hasMoreTokens()) {
      nsDependentSubstring token = tokenizer.nextToken();

      if (token.LowerCaseEqualsLiteral("allow-scripts")) {
        out &= ~SANDBOXED_SCRIPTS;
      } else if (token.LowerCaseEqualsLiteral("allow-same-origin")) {
        out &= ~SANDBOXED_ORIGIN;
      } else if (token.LowerCaseEqualsLiteral("allow-forms")) {
        out &= ~SANDBOXED_FORMS;
      } else if (token.LowerCaseEqualsLiteral("allow-scripts")) {
        // allow-scripts removes both SANDBOXED_SCRIPTS and
        // SANDBOXED_AUTOMATIC_FEATURES.
        out &= ~SANDBOXED_SCRIPTS;
        out &= ~SANDBOXED_AUTOMATIC_FEATURES;
      } else if (token.LowerCaseEqualsLiteral("allow-top-navigation")) {
        out &= ~SANDBOXED_TOPLEVEL_NAVIGATION;
      }
    }
  }

  return out;
}

#ifdef MOZ_XTF
nsIXTFService*
nsContentUtils::GetXTFService()
{
  if (!sXTFService) {
    nsresult rv = CallGetService(kXTFServiceCID, &sXTFService);
    if (NS_FAILED(rv)) {

                             aResult);
}

// static
bool
nsContentUtils::SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
                                  nsIChannel* aChannel,
                                  nsIURI* aURI,
                                  bool aSetUpForAboutBlank,
                                  bool aForceOwner)
{
  //
  // Set the owner of the channel, but only for channels that can't
  // provide their own security context.
  //
  // XXX: It seems wrong that the owner is ignored - even if one is
  //      supplied) unless the URI is javascript or data or about:blank.
  // XXX: If this is ever changed, check all callers for what owners

  //      comments in nsDocShell::LoadURI where we fall back on
  //      inheriting the owner if called from chrome.  That would be
  //      very wrong if this code changed anything but channels that
  //      can't provide their own security context!
  //
  //      (Currently chrome URIs set the owner when they are created!
  //      So setting a NULL owner would be bad!)
  //
  // If aForceOwner is true, the owner will be set, even for a channel that
  // can provide its own security context. This is used for the HTML5 IFRAME
  // sandbox attribute, so we can force the channel (and its document) to
  // explicitly have a null principal.
  bool inherit;
  // We expect URIInheritsSecurityContext to return success for an
  // about:blank URI, so don't call NS_IsAboutBlank() if this call fails.
  // This condition needs to match the one in nsDocShell::InternalLoad where
  // we're checking for things that will use the owner.
  if (aForceOwner || ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
      (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))))) {
    // Be certain that aForceOwner is only set for null principals
    if (aForceOwner) {
      nsCOMPtr<nsIURI> ownerURI;
      nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
      MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
    }
    aChannel->SetOwner(aLoadingPrincipal);
    return true;
  }

  //
  // file: uri special-casing
  //
  // If this is a file: load opened from another file: then it may need





    FindCharInReadable(';', semicolon, end);
    SetContentTypeInternal(Substring(start, semicolon));
  }

  RetrieveRelevantHeaders(aChannel);

  mChannel = aChannel;

  // If this document is being loaded by a docshell, copy its sandbox flags
  // to the document. These are immutable after being set here.
  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(aContainer);

  if (docShell) {
    nsresult rv = docShell->GetSandboxFlags(&mSandboxFlags);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  nsresult rv = InitCSP();
  NS_ENSURE_SUCCESS(rv, rv);

  return NS_OK;
}

nsresult
nsDocument::InitCSP()





#include "mozilla/GuardObjects.h"
#include "mozilla/Preferences.h"
#include "mozilla/unused.h"
#include "mozilla/dom/Element.h"
#include "mozilla/layout/RenderFrameParent.h"

#include "jsapi.h"

#include "nsHTMLIFrameElement.h"
#include "nsSandboxFlags.h"

using namespace mozilla;
using namespace mozilla::dom;
using namespace mozilla::layers;
using namespace mozilla::layout;
typedef FrameMetrics::ViewID ViewID;

class nsAsyncDocShellDestroyer : public nsRunnable
{

  // Just to be safe, recheck uri.
  rv = CheckURILoad(mURIToLoad);
  NS_ENSURE_SUCCESS(rv, rv);

  nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
  mDocShell->CreateLoadInfo(getter_AddRefs(loadInfo));
  NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);

  // Is this an <iframe> with a sandbox attribute or a parent which is
  // sandboxed ?
  nsHTMLIFrameElement* iframe =
    nsHTMLIFrameElement::FromContent(mOwnerContent);

  PRUint32 sandboxFlags = 0;

  if (iframe) {
    sandboxFlags = iframe->GetSandboxFlags();

    // The OwnerDoc of an iframe node is the parent document of that <iframe>.
    PRUint32 parentSandboxFlags = iframe->OwnerDoc() ?
      iframe->OwnerDoc()->SandboxFlags() : 0;

    if (sandboxFlags || parentSandboxFlags) {
      // The child can only add restrictions, not remove them.
      sandboxFlags |= parentSandboxFlags;

      mDocShell->SetSandboxFlags(sandboxFlags);

      // Set up the actual sandboxing for plugins as specified.
      if (sandboxFlags & SANDBOXED_PLUGINS) {
        mDocShell->SetAllowPlugins(false);
      }
    }
  }

  // If this is an <iframe> and it's sandboxed with respect to origin
  // we will set it up with a null principal later in nsDocShell::DoURILoad.
  // We do it there to correctly sandbox content that was loaded into
  // the iframe via other methods than the src attribute.
  // We'll use our principal, not that of the document loaded inside us.  This
  // is very important; needed to prevent XSS attacks on documents loaded in
  // subframes!
  loadInfo->SetOwner(mOwnerContent->NodePrincipal());

  nsCOMPtr<nsIURI> referrer;
  rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
  NS_ENSURE_SUCCESS(rv, rv);





GK_ATOM(address, "address")
GK_ATOM(after, "after")
GK_ATOM(after_end, "after_end")
GK_ATOM(after_start, "after_start")
GK_ATOM(align, "align")
GK_ATOM(alink, "alink")
GK_ATOM(all, "all")
GK_ATOM(allowevents, "allowevents")
GK_ATOM(allowforms, "allow-forms")
GK_ATOM(allownegativeassertions, "allownegativeassertions")
GK_ATOM(allowsameorigin, "allow-same-origin")
GK_ATOM(allowscripts, "allow-scripts")
GK_ATOM(allowtopnavigation, "allow-top-navigation")
GK_ATOM(allowuntrusted, "allowuntrusted")
GK_ATOM(alt, "alt")
GK_ATOM(alternate, "alternate")
GK_ATOM(always, "always")
GK_ATOM(ancestor, "ancestor")
GK_ATOM(ancestorOrSelf, "ancestor-or-self")
GK_ATOM(_and, "and")
GK_ATOM(any, "any")

GK_ATOM(rp, "rp")
GK_ATOM(rt, "rt")
GK_ATOM(rtl, "rtl")
GK_ATOM(ruby, "ruby")
GK_ATOM(rule, "rule")
GK_ATOM(rules, "rules")
GK_ATOM(s, "s")
GK_ATOM(samp, "samp")
GK_ATOM(sandbox, "sandbox")
GK_ATOM(sbattr, "sbattr")
GK_ATOM(scale, "scale")
GK_ATOM(scan, "scan")
GK_ATOM(scheme, "scheme")
GK_ATOM(scope, "scope")
GK_ATOM(scoped, "scoped")
GK_ATOM(screen, "screen")
GK_ATOM(screenX, "screenX")

-      Line
+  Link Here
-      Line 0
+  Link Here
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+ * Constant flags that describe how a document is sandboxed according to the
+ * HTML5 spec.
+ */
+#ifndef nsSandboxFlags_h___
+#define nsSandboxFlags_h___
+/**
+ * This flag prevents content from navigating browsing contexts other than
+ * the sandboxed browsing context itself (or browsing contexts further
+ * nested inside it), and the top-level browsing context.
+ */
+const unsigned long SANDBOXED_NAVIGATION  = 0x1;
+/**
+ * This flag prevents content from navigating their top-level browsing
+ * context.
+ */
+const unsigned long SANDBOXED_TOPLEVEL_NAVIGATION = 0x2;
+/**
+ * This flag prevents content from instantiating plugins, whether using the
+ * embed element, the object element, the applet element, or through
+ * navigation of a nested browsing context, unless those plugins can be
+ * secured.
+ */
+const unsigned long SANDBOXED_PLUGINS = 0x4;
+/**
+ * This flag forces content into a unique origin, thus preventing it from
+ * accessing other content from the same origin.
+ * This flag also prevents script from reading from or writing to the
+ * document.cookie IDL attribute, and blocks access to localStorage.
+ */
+const unsigned long SANDBOXED_ORIGIN = 0x8;
+/**
+ * This flag blocks form submission.
+ */
+const unsigned long SANDBOXED_FORMS = 0x10;
+/**
+ * This flag blocks script execution.
+ */
+const unsigned long SANDBOXED_SCRIPTS = 0x20;
+/**
+ * This flag blocks features that trigger automatically, such as
+ * automatically playing a video or automatically focusing a form control.
+ */
+const unsigned long SANDBOXED_AUTOMATIC_FEATURES = 0x40;
+#endif





#include "nsIContentSecurityPolicy.h"
#include "prlog.h"
#include "nsIChannelPolicy.h"
#include "nsChannelPolicy.h"
#include "nsCRT.h"
#include "nsContentCreatorFunctions.h"
#include "nsGenericElement.h"
#include "nsCrossSiteListenerProxy.h"
#include "nsSandboxFlags.h"

#include "mozilla/FunctionTimer.h"
#include "mozilla/CORSMode.h"

#ifdef PR_LOGGING
static PRLogModuleInfo* gCspPRLog;
#endif


  if (!window) {
    return NS_ERROR_NULL_POINTER;
  }

  nsIDocShell *docshell = window->GetDocShell();

  nsCOMPtr<nsIInterfaceRequestor> prompter(do_QueryInterface(docshell));

  // If this document is sandboxed without 'allow-scripts', abort.
  if (mDocument->SandboxFlags() & SANDBOXED_SCRIPTS) {
    // REVIEW : this probably isn't the right error..
    return NS_ERROR_DOM_SECURITY_ERR;
  }

  // check for a Content Security Policy to pass down to the channel
  // that will be created to load the script
  nsCOMPtr<nsIChannelPolicy> channelPolicy;
  nsCOMPtr<nsIContentSecurityPolicy> csp;
  rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
  NS_ENSURE_SUCCESS(rv, rv);
  if (csp) {
    channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");

        "There can be only one parser-blocking script at a time");
    NS_ASSERTION(mXSLTRequests.IsEmpty(),
        "Parser-blocking scripts and XSLT scripts in the same doc!");
    mParserBlockingRequest = request;
    return true;
  }

  // inline script
  // Is this document sandboxed without 'allow-scripts'?
  if (mDocument->SandboxFlags() & SANDBOXED_SCRIPTS) {
    return false;
  }

  nsCOMPtr<nsIContentSecurityPolicy> csp;
  rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
  NS_ENSURE_SUCCESS(rv, false);

  if (csp) {
    PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader i ****with CSP****"));
    bool inlineOK;
    rv = csp->GetAllowsInlineScript(&inlineOK);





#include "nsDOMJSUtils.h"
#include "nsDOMScriptObjectHolder.h"
#include "nsDataHashtable.h"
#include "nsCOMArray.h"
#include "nsEventListenerService.h"
#include "nsIContentSecurityPolicy.h"
#include "nsJSEnvironment.h"
#include "xpcpublic.h"
#include "nsSandboxFlags.h"

using namespace mozilla::dom;
using namespace mozilla::hal;

#define EVENT_TYPE_EQUALS( ls, type, userType ) \
  (ls->mEventType == type && \
  (ls->mEventType != NS_USER_DEFINED_EVENT || ls->mTypeAtom == userType))


    // loaded as data.
    return NS_OK;
  }

  nsresult rv = NS_OK;
  // return early preventing the event listener from being added
  // 'doc' is fetched above
  if (doc) {
    // Don't allow adding an event listener if the document is sandboxed
    // without 'allow-scripts'.
    if (doc->SandboxFlags() & SANDBOXED_SCRIPTS) {
      return NS_ERROR_DOM_SECURITY_ERR;
    }

    nsCOMPtr<nsIContentSecurityPolicy> csp;
    rv = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
    NS_ENSURE_SUCCESS(rv, rv);

    if (csp) {
      bool inlineOK;
      rv = csp->GetAllowsInlineScript(&inlineOK);
      NS_ENSURE_SUCCESS(rv, rv);






#include "mozAutoDocUpdate.h"
#include "nsIHTMLCollection.h"

#include "nsIConstraintValidation.h"

#include "nsIDOMHTMLButtonElement.h"
#include "dombindings.h"
#include "nsSandboxFlags.h"

using namespace mozilla::dom;

static const int NS_FORM_CONTROL_LIST_HASHTABLE_SIZE = 16;

static const PRUint8 NS_FORM_AUTOCOMPLETE_ON  = 1;
static const PRUint8 NS_FORM_AUTOCOMPLETE_OFF = 0;


    return DoReset();
  }

  if (NS_FORM_SUBMIT == aMessage) {
    // Don't submit if we're not in a document.
    if (!doc) {
      return NS_OK;
    }
    // Don't submit if we're in a sandboxed frame and form submit
    // is disabled.
    return (doc->SandboxFlags() & SANDBOXED_FORMS) ? NS_OK : DoSubmit(aEvent);
  }

  MOZ_ASSERT(false);
  return NS_OK;
}

nsresult
nsHTMLFormElement::DoReset()

   * TODO: the check for observer should be removed later when HTML5 Forms will
   * be spread enough and authors will assume forms can't be submitted when
   * invalid. See bug 587671.
   */

  NS_ASSERTION(!HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate),
               "We shouldn't be there if novalidate is set!");

  // Don't do validation for a form submit done by a sandboxed document that
  // doesn't have 'allow-forms', the submit will have been blocked and the
  // HTML5 spec says we shouldn't validate in this case.
  nsIDocument* doc = GetCurrentDoc();
  if (doc && (doc->SandboxFlags() & SANDBOXED_FORMS)) {
      return true;
  }

  // When .submit() is called aEvent = nsnull so we can rely on that to know if
  // we have to check the validity of the form.
  nsCOMPtr<nsIObserverService> service =
    mozilla::services::GetObserverService();
  if (!service) {
    NS_WARNING("No observer service available!");
    return true;
  }





/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "mozilla/Util.h"

#include "nsHTMLIFrameElement.h"
#include "nsIDOMDocument.h"
#include "nsIDOMSVGDocument.h"
#include "nsGkAtoms.h"
#include "nsIDocument.h"
#include "nsMappedAttributes.h"
#include "nsDOMError.h"
#include "nsRuleData.h"
#include "nsStyleConsts.h"

using namespace mozilla;
using namespace mozilla::dom;

NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(IFrame)

nsHTMLIFrameElement::nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                                         FromParser aFromParser)

NS_IMPL_URI_ATTR(nsHTMLIFrameElement, LongDesc, longdesc)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, MarginHeight, marginheight)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, MarginWidth, marginwidth)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Name, name)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Scrolling, scrolling)
NS_IMPL_URI_ATTR(nsHTMLIFrameElement, Src, src)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Width, width)
NS_IMPL_BOOL_ATTR(nsHTMLIFrameElement, MozAllowFullScreen, mozallowfullscreen)
NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Sandbox, sandbox)

void
nsHTMLIFrameElement::GetItemValueText(nsAString& aValue)
{
  GetSrc(aValue);
}

void



nsMapRuleToAttributesFunc
nsHTMLIFrameElement::GetAttributeMappingFunction() const
{
  return &MapAttributesIntoRule;
}

nsresult
nsHTMLIFrameElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                    const nsAttrValue* aValue,
                                    bool aNotify)
{
  if (aName == nsGkAtoms::sandbox && aNameSpaceID == kNameSpaceID_None) {
    // Parse the new value of the sandbox attribute, and if we have a docshell
    // set its sandbox flags appropriately.
    if (mFrameLoader) {
      nsCOMPtr<nsIDocShell> docshell = mFrameLoader->GetExistingDocShell();

      if (docshell) {
        PRUint32 newFlags = 0;
        // If a NULL aValue is passed in, we want to clear the sandbox flags
        // which we will do by setting them to 0.
        if (aValue) {
          nsAutoString strValue;
          aValue->ToString(strValue);
          newFlags = nsContentUtils::ParseSandboxAttributeToFlags(
            strValue);
        }
        docshell->SetSandboxFlags(newFlags);
      }
    }
  }
  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue,
                                            aNotify);

}





/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "nsGenericHTMLFrameElement.h"
#include "nsIDOMHTMLIFrameElement.h"
#include "nsIDOMGetSVGDocument.h"
#include "nsIDOMSVGDocument.h"
#include "nsGkAtoms.h"
#include "nsIDocument.h"
#include "nsMappedAttributes.h"
#include "nsDOMError.h"
#include "nsRuleData.h"
#include "nsStyleConsts.h"
#include "nsContentUtils.h"

class nsHTMLIFrameElement : public nsGenericHTMLFrameElement
                          , public nsIDOMHTMLIFrameElement
                          , public nsIDOMGetSVGDocument
{
public:
  nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                      mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);

                                nsAttrValue& aResult);
  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
  virtual nsXPCClassInfo* GetClassInfo();
  virtual nsIDOMNode* AsDOMNode() { return this; }

  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                const nsAttrValue* aValue,
                                bool aNotify);

  PRUint32 GetSandboxFlags()
  {
    nsAutoString sandboxAttr;

    if (GetAttr(kNameSpaceID_None, nsGkAtoms::sandbox, sandboxAttr)) {
      return nsContentUtils::ParseSandboxAttributeToFlags(sandboxAttr);
    }

    // No sandbox attribute, no sandbox flags.
    return 0;
  }

  static nsHTMLIFrameElement* FromContent(nsIContent *aContent)
  {
    if (aContent->IsHTML(nsGkAtoms::iframe)) {
      return static_cast<nsHTMLIFrameElement*>(aContent);
    }
    return nsnull;
  }

protected:
  virtual void GetItemValueText(nsAString& text);
  virtual void SetItemValueText(const nsAString& text);
};





#include "prprf.h"
#include "mozilla/dom/Element.h"
#include "mozilla/Preferences.h"
#include "nsMimeTypes.h"
#include "nsIRequest.h"
#include "nsHtml5TreeOpExecutor.h"
#include "nsHtml5Parser.h"
#include "nsIDOMJSWindow.h"
#include "nsSandboxFlags.h"

using namespace mozilla;
using namespace mozilla::dom;

#define NS_MAX_DOCUMENT_WRITE_DEPTH 20

#include "prmem.h"
#include "prtime.h"

{
  aCookie.Truncate(); // clear current cookie in case service fails;
                      // no cookie isn't an error condition.

  if (mDisableCookieAccess) {
    return NS_OK;
  }

  // If the document's sandboxed origin flag is set, access to read cookies
  // is prohibited.
  if (mSandboxFlags & SANDBOXED_ORIGIN) {
    return NS_ERROR_DOM_SECURITY_ERR;
  }
  
  // not having a cookie service isn't an error
  nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
  if (service) {
    // Get a URI from the document principal. We use the original
    // codebase in case the codebase was changed by SetDomain
    nsCOMPtr<nsIURI> codebaseURI;
    NodePrincipal()->GetURI(getter_AddRefs(codebaseURI));



NS_IMETHODIMP
nsHTMLDocument::SetCookie(const nsAString& aCookie)
{
  if (mDisableCookieAccess) {
    return NS_OK;
  }

  // If the document's sandboxed origin flag is set, access to write cookies
  // is prohibited.
  if (mSandboxFlags & SANDBOXED_ORIGIN) {
    return NS_ERROR_DOM_SECURITY_ERR;
  }

  // not having a cookie service isn't an error
  nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
  if (service && mDocumentURI) {
    nsCOMPtr<nsIPrompt> prompt;
    nsCOMPtr<nsPIDOMWindow> window = GetWindow();
    if (window) {
      window->GetPrompter(getter_AddRefs(prompt));
    }

(-)a/docshell/base/Makefile.in (+1 lines)

Line	Link Here

Lines 85-93 include $(topsrcdir)/config/config.mk	Link Here

include $(topsrcdir)/ipc/chromium/chromium-config.mk

include $(topsrcdir)/ipc/chromium/chromium-config.mk

include $(topsrcdir)/config/rules.mk

include $(topsrcdir)/config/rules.mk

LOCAL_INCLUDES += \

LOCAL_INCLUDES += \

  -I$(srcdir)/../shistory/src \

  -I$(srcdir)/../shistory/src \

  -I$(topsrcdir)/dom/base \

  -I$(topsrcdir)/dom/base \

  -I$(topsrcdir)/layout/base \

  -I$(topsrcdir)/layout/base \

  -I$(topsrcdir)/xpcom/ds \

  -I$(topsrcdir)/xpcom/ds \

  -I$(topsrcdir)/content/base/src \

  $(NULL)

  $(NULL)





#include "nsIWebBrowserPrint.h"
#endif

#include "nsPluginError.h"
#include "nsContentUtils.h"
#include "nsContentErrors.h"
#include "nsIChannelPolicy.h"
#include "nsIContentSecurityPolicy.h"
#include "nsSandboxFlags.h"

#include "nsXULAppAPI.h"

#include "nsDOMNavigationTiming.h"
#include "nsITimedChannel.h"
#include "mozilla/StartupTimeline.h"
#include "nsIFrameMessageManager.h"


    mBusyFlags(BUSY_FLAGS_NONE),
    mAppType(nsIDocShell::APP_TYPE_UNKNOWN),
    mLoadType(0),
    mMarginWidth(-1),
    mMarginHeight(-1),
    mItemType(typeContent),
    mPreviousTransIndex(-1),
    mLoadedTransIndex(-1),
    mSandboxFlags(0),
    mCreated(false),
    mAllowSubframes(true),
    mAllowPlugins(true),
    mAllowJavascript(true),
    mAllowMetaRedirects(true),
    mAllowImages(true),
    mAllowDNSPrefetch(true),
    mAllowWindowControl(true),

            foundItem = nsnull;
        }

        if (foundItem) {
            // We return foundItem here even if it's not an active
            // item since all the names we've dealt with so far are
            // special cases that we won't bother looking for further.

            // If our document is sandboxed, we need to do some extra checks.
            PRUint32 sandboxFlags = 0;

            nsCOMPtr<nsIDocument> doc = do_GetInterface(aOriginalRequestor);

            if (doc) {
                sandboxFlags = doc->SandboxFlags();
            }

            if (sandboxFlags) {
                nsCOMPtr<nsIDocShellTreeItem> root;
                GetSameTypeRootTreeItem(getter_AddRefs(root));

                // Is the found item not a top level browsing context and not ourself ?
                nsCOMPtr<nsIDocShellTreeItem> selfAsItem = static_cast<nsIDocShellTreeItem *>(this);
                if (foundItem != root && foundItem != selfAsItem) {
                    // Are we an ancestor of the foundItem ?
                    bool isAncestor = false;

                    nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
                    GetSameTypeParent(getter_AddRefs(parentAsItem));

                    while (parentAsItem) {
                        nsCOMPtr<nsIDocShellTreeItem> tmp;
                        parentAsItem->GetParent(getter_AddRefs(tmp));

                        if (tmp && tmp == selfAsItem) {
                            isAncestor = true;
                            break;
                        }
                        parentAsItem = tmp;
                    }

                    if (!isAncestor) {
                        // No, we are not an ancestor and our document is
                        // sandboxed, we can't allow this.
                        foundItem = nsnull;
                    }
                } else {
                    // Top level browsing context - is it an ancestor of ours ?
                    nsCOMPtr<nsIDocShellTreeItem> tmp;
                    GetSameTypeParent(getter_AddRefs(tmp));

                    while (tmp) {
                        if (tmp && tmp == foundItem) {
                            // This is an ancestor, and we are sandboxed.
                            // Unless allow-top-navigation is set, we can't allow this.
                            if (sandboxFlags & SANDBOXED_TOPLEVEL_NAVIGATION) {
                              foundItem = nsnull;
                            }
                            break;
                        }
                        tmp->GetParent(getter_AddRefs(tmp));
                    }
                }
            }

            foundItem.swap(*_retval);
            return NS_OK;
        }
    }

    // Keep looking
        
    // First we check our name.

NS_IMETHODIMP
nsDocShell::GetIsAppTab(bool *aIsAppTab)
{
  *aIsAppTab = mIsAppTab;
  return NS_OK;
}

NS_IMETHODIMP
nsDocShell::SetSandboxFlags(PRUint32 aSandboxFlags)
{
    mSandboxFlags = aSandboxFlags;
    return NS_OK;
}

NS_IMETHODIMP
nsDocShell::GetSandboxFlags(PRUint32  *aSandboxFlags)
{
    *aSandboxFlags = mSandboxFlags;
    return NS_OK;
}

NS_IMETHODIMP
nsDocShell::SetVisibility(bool aVisibility)
{
    if (!mContentViewer)
        return NS_OK;
    if (aVisibility) {
        mContentViewer->Show();
    }
    else {

        nsCOMPtr<nsIDocShellTreeItem> targetItem;
        FindItemWithName(aWindowTarget, nsnull, this,
                         getter_AddRefs(targetItem));

        nsCOMPtr<nsIDocShell> targetDocShell = do_QueryInterface(targetItem);
        
        bool isNewWindow = false;
        if (!targetDocShell) {
            // If the docshell's document is sandboxed and was trying to
            // navigate/load a frame it wasn't allowed to access, the
            // FindItemWithName above will have returned null for the target
            // item - we don't want to actually open a new window in this case
            // though. Check if we are sandboxed and bail out here if so.
            NS_ENSURE_TRUE(mContentViewer, NS_ERROR_FAILURE);
            nsIDocument* doc = mContentViewer->GetDocument();
            PRUint32 sandboxFlags = 0;
            sandboxFlags = doc->SandboxFlags();
            if (sandboxFlags & SANDBOXED_NAVIGATION) {
                return NS_ERROR_FAILURE;
            }

            nsCOMPtr<nsIDOMWindow> win =
                do_GetInterface(GetAsSupports(this));
            NS_ENSURE_TRUE(win, NS_ERROR_NOT_AVAILABLE);

            nsDependentString name(aWindowTarget);
            nsCOMPtr<nsIDOMWindow> newWin;
            rv = win->Open(EmptyString(), // URL to load
                           name,          // window name

        }
        // Set the referrer explicitly
        if (aReferrerURI && aSendReferrer) {
            // Referrer is currenly only set for link clicks here.
            httpChannel->SetReferrer(aReferrerURI);
        }
    }

    nsCOMPtr<nsIPrincipal> ownerPrincipal;

    // If the content being loaded should be sandboxed with respect to origin
    // we need to create a new null principal here, and then tell
    // nsContentUtils::SetUpChannelOwner to force it to be set as the
    // channel owner.
    if (mSandboxFlags & SANDBOXED_ORIGIN) {
        ownerPrincipal = do_CreateInstance("@mozilla.org/nullprincipal;1");
    } else {
        // Not sandboxed - we allow the content to assume its natural owner.
        ownerPrincipal = do_QueryInterface(aOwner);
    }

    nsContentUtils::SetUpChannelOwner(ownerPrincipal, channel, aURI, true,
                                      (mSandboxFlags & SANDBOXED_ORIGIN));

    nsCOMPtr<nsIScriptChannel> scriptChannel = do_QueryInterface(channel);
    if (scriptChannel) {
        // Allow execution against our context if the principals match
        scriptChannel->
            SetExecutionPolicy(nsIScriptChannel::EXECUTE_NORMAL);
    }






    // Create() is called, the type is not expected to change.
    PRInt32                    mItemType;

    // Index into the SHTransaction list, indicating the previous and current
    // transaction at the time that this DocShell begins to load
    PRInt32                    mPreviousTransIndex;
    PRInt32                    mLoadedTransIndex;

    PRUint32                   mSandboxFlags;

    bool                       mCreated;
    bool                       mAllowSubframes;
    bool                       mAllowPlugins;
    bool                       mAllowJavascript;
    bool                       mAllowMetaRedirects;
    bool                       mAllowImages;
    bool                       mAllowDNSPrefetch;
    bool                       mAllowWindowControl;





interface nsILayoutHistoryState;
interface nsISecureBrowserUI;
interface nsIDOMStorage;
interface nsIPrincipal;
interface nsIWebBrowserPrint;
interface nsIVariant;
interface nsIPrivacyTransitionObserver;

[scriptable, uuid(9b283337-097d-4fa8-a2da-916318eaf828)]
interface nsIDocShell : nsISupports
{
  /**
   * Loads a given URI.  This will give priority to loading the requested URI
   * in the object implementing	this interface.  If it can't be loaded here
   * however, the URL dispatcher will go through its normal process of content
   * loading.
   *

   */
  attribute bool isBrowserFrame;

  /*
   * Is this docshell contained in an <iframe mozbrowser>, either directly or
   * indirectly?
   */
  readonly attribute bool containedInBrowserFrame;

  /**
   * The sandbox flags on the docshell. These reflect the value of the sandbox
   * attribute of the associated IFRAME or CSP-protectable content, if
   * existent. See the HTML5 spec for more details.
   * These flags on the docshell reflect the current state of the sandbox
   * attribute, which is modifiable. They are only used when loading new
   * content, sandbox flags are also immutably set on the document when it is
   * loaded.
   * The sandbox flags of a document depend on the sandbox flags on its
   * docshell and of its parent document, if any.
   * See nsSandboxFlags.h for the possible flags.
   */
  attribute unsigned long sandboxFlags;
};





#include "nsRefreshDriver.h"
#include "mozAutoDocUpdate.h"

#include "mozilla/Telemetry.h"
#include "nsLocation.h"
#include "nsWrapperCacheInlines.h"
#include "nsDOMEventTargetHelper.h"
#include "nsIAppsService.h"
#include "nsSandboxFlags.h"

#ifdef ANDROID
#include <android/log.h>
#endif

#ifdef PR_LOGGING
static PRLogModuleInfo* gDOMLeakPRLog;
#endif

  if (!mSessionStorage) {
    *aSessionStorage = nsnull;

    nsString documentURI;
    if (mDocument) {
      mDocument->GetDocumentURI(documentURI);
    }

    // If the document has the sandboxed origin flag set
    // don't allow access to localStorage.
    if (mDoc && (mDoc->SandboxFlags() & SANDBOXED_ORIGIN)) {
      return NS_ERROR_DOM_SECURITY_ERR;
    }

    nsresult rv = docShell->GetSessionStorageForPrincipal(principal,
                                                          documentURI,
                                                          true,
                                                          getter_AddRefs(mSessionStorage));
    NS_ENSURE_SUCCESS(rv, rv);

#ifdef PR_LOGGING
    if (PR_LOG_TEST(gDOMLeakPRLog, PR_LOG_DEBUG)) {

      do_GetService("@mozilla.org/dom/storagemanager;1", &rv);
    NS_ENSURE_SUCCESS(rv, rv);

    nsString documentURI;
    if (mDocument) {
      mDocument->GetDocumentURI(documentURI);
    }

    // If the document has the sandboxed origin flag set
    // don't allow access to localStorage.
    if (mDoc && (mDoc->SandboxFlags() & SANDBOXED_ORIGIN)) {
      return NS_ERROR_DOM_SECURITY_ERR;
    }

    nsIDocShell* docShell = GetDocShell();
    nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(docShell);

    rv = storageManager->GetLocalStorageForPrincipal(principal,
                                                     documentURI,
                                                     loadContext && loadContext->UsePrivateBrowsing(),
                                                     getter_AddRefs(mLocalStorage));
    NS_ENSURE_SUCCESS(rv, rv);





 *
 * This interface is trying to follow the DOM Level 2 HTML specification:
 * http://www.w3.org/TR/DOM-Level-2-HTML/
 *
 * with changes from the work-in-progress WHATWG HTML specification:
 * http://www.whatwg.org/specs/web-apps/current-work/
 */

[scriptable, uuid(52f6244b-b1f5-4f4c-8ff3-7e146316f411)]
interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
{
           attribute DOMString        align;
           attribute DOMString        frameBorder;
           attribute DOMString        height;
           attribute DOMString        longDesc;
           attribute DOMString        marginHeight;
           attribute DOMString        marginWidth;
           attribute DOMString        name;
           attribute DOMString        scrolling;
           attribute DOMString        src;
           attribute DOMString        width;
  // Introduced in DOM Level 2:
  readonly attribute nsIDOMDocument   contentDocument;
  readonly attribute nsIDOMWindow     contentWindow;

           attribute DOMString        sandbox;
  // Mozilla extensions
  // iframe elements require the mozAllowFullScreen attribute to be present
  // if they're to allow content in the sub document to go into DOM full-screen
  // mode. See https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI
           attribute boolean          mozAllowFullScreen;
};





CPPSRCS		= nsJSProtocolHandler.cpp

EXPORTS		= $(srcdir)/nsJSProtocolHandler.h

LOCAL_INCLUDES += \
		-I$(srcdir) \
		-I$(topsrcdir)/dom/base \
		-I$(topsrcdir)/netwerk/base/src \
		-I$(topsrcdir)/content/base/src \

ifdef BUILD_DEBUG_GC
DEFINES		+= -DDEBUG_GC
endif

DIRS            = $(NULL)
TEST_DIRS += test






#include "nsThreadUtils.h"
#include "nsIJSContextStack.h"
#include "nsIScriptChannel.h"
#include "nsIDocument.h"
#include "nsIObjectInputStream.h"
#include "nsIObjectOutputStream.h"
#include "nsIWritablePropertyBag2.h"
#include "nsIContentSecurityPolicy.h"
#include "nsSandboxFlags.h"

static NS_DEFINE_CID(kJSURICID, NS_JSURI_CID);

class nsJSThunk : public nsIInputStream
{
public:
    nsJSThunk();


    // Get the global object we should be running on.
    nsIScriptGlobalObject* global = GetGlobalObject(aChannel);
    if (!global) {
        return NS_ERROR_FAILURE;
    }

    nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(global));

    // Sandboxed document check: javascript: URI's are disabled
    // in a sandboxed document unless 'allow-scripts' was specified

    // REVIEW - it seems like the original inner window would be the one
    // that will execute the javascript with its principal - is this
    // assumption correct ?? (and is GetExtantDocument() the right way
    // to get the right document ??
    nsCOMPtr<nsIDocument> doc = do_QueryInterface(aOriginalInnerWindow->GetExtantDocument());
    if (doc && (doc->SandboxFlags() & SANDBOXED_SCRIPTS)) {
      return NS_ERROR_DOM_RETVAL_UNDEFINED;
    }

    // Push our popup control state
    nsAutoPopupStatePusher popupStatePusher(win, aPopupState);

    // Make sure we still have the same inner window as we used to.
    nsPIDOMWindow *innerWin = win->GetCurrentInnerWindow();

    if (innerWin != aOriginalInnerWindow) {
        return NS_ERROR_UNEXPECTED;

(-)a/embedding/components/windowwatcher/src/Makefile.in (-1 / +2 lines)

Line	Link Here

Lines 24-34 CPPSRCS += nsDialogParamBlock.cpp \	Link Here

		   $(NULL)

		   $(NULL)

endif

endif

# we don't want the shared lib, but we want to force the creation of a

# we don't want the shared lib, but we want to force the creation of a

# static lib.

# static lib.

FORCE_STATIC_LIB = 1

FORCE_STATIC_LIB = 1

# For nsJSUtils

# For nsJSUtils

LOCAL_INCLUDES += -I$(topsrcdir)/dom/base

LOCAL_INCLUDES += -I$(topsrcdir)/dom/base \

		  -I$(topsrcdir)/content/base/src \

include $(topsrcdir)/config/rules.mk

include $(topsrcdir)/config/rules.mk





#include "nsPIDOMStorage.h"
#include "nsIWidget.h"
#include "nsFocusManager.h"
#include "nsIPresShell.h"
#include "nsPresContext.h"
#include "nsContentUtils.h"
#include "nsIPrefBranch.h"
#include "nsIPrefService.h"
#include "nsSandboxFlags.h"

#ifdef USEWEAKREFS
#include "nsIWeakReference.h"
#endif

using namespace mozilla;

static const char *sJSStackContractID="@mozilla.org/js/xpc/ContextStack;1";

  }

  if (!newDocShellItem) {
    // We're going to either open up a new window ourselves or ask a
    // nsIWindowProvider for one.  In either case, we'll want to set the right
    // name on it.
    windowNeedsName = true;

    // If the parent trying to open a new window is sandboxed,
    // this is not allowed and we fail here.
    if (aParent) {
      nsCOMPtr<nsIDOMDocument> domdoc;
      aParent->GetDocument(getter_AddRefs(domdoc));
      nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);

      if (doc) {
        PRUint32 sandboxFlags = 0;
        sandboxFlags = doc->SandboxFlags();

        if (sandboxFlags & SANDBOXED_NAVIGATION) {
          return NS_ERROR_FAILURE;
        }
      }
    }

    // Now check whether it's ok to ask a window provider for a window.  Don't
    // do it if we're opening a dialog or if our parent is a chrome window or
    // if we're opening something that has modal, dialog, or chrome flags set.
    nsCOMPtr<nsIDOMChromeWindow> chromeWin = do_QueryInterface(aParent);
    if (!aDialog && !chromeWin &&
        !(chromeFlags & (nsIWebBrowserChrome::CHROME_MODAL         |
                         nsIWebBrowserChrome::CHROME_OPENAS_DIALOG | 
                         nsIWebBrowserChrome::CHROME_OPENAS_CHROME))) {

Return to bug 341604