Attachment 633209 Details for Bug 341604

[patch] iframe sandbox v16

iframe_sandbox (text/plain), 50.61 KB, created by Ian Melven :imelven

(hide)

Description:

Filename:

MIME Type:

Creator: Ian Melven :imelven

Size: 50.61 KB

patch

obsolete

># HG changeset patch
># Parent 8cf5423b021396e96c096443431e0e0b0f0c6d69
># User Ian Melven <imelven@mozilla.com>
>iframe sandbox
>* * *
>change sandbox to DOMString
>
>diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
>--- a/content/base/public/nsContentUtils.h
>+++ b/content/base/public/nsContentUtils.h
>@@ -816,16 +816,27 @@ public:
>   /**
>    * Get the localized string named |aKey| in properties file |aFile|.
>    */
>   static nsresult GetLocalizedString(PropertiesFile aFile,
>                                      const char* aKey,
>                                      nsXPIDLString& aResult);
> 
>   /**
>+   * A helper function that parses a sandbox attribute (of an <iframe> or
>+   * a CSP directive) and converts it to the set of flags used internally.
>+   *
>+   * @param aAttribute 	the value of the sandbox attribute
>+   * @return 			the set of flags
>+   */
>+  static PRUint32 ParseSandboxAttributeToFlags(const nsAString&
>+                                                 aSandboxAttr);
>+
>+
>+  /**
>    * Fill (with the parameters given) the localized string named |aKey| in
>    * properties file |aFile|.
>    */
> private:
>   static nsresult FormatLocalizedString(PropertiesFile aFile,
>                                         const char* aKey,
>                                         const PRUnichar** aParams,
>                                         PRUint32 aParamsLength,
>@@ -1935,42 +1946,44 @@ public:
>    * from the document it comes from.
>    */
>   static nsresult URIInheritsSecurityContext(nsIURI *aURI, bool *aResult);
> 
>   /**
>    * Set the given principal as the owner of the given channel, if
>    * needed.  aURI must be the URI of aChannel.  aPrincipal may be
>    * null.  If aSetUpForAboutBlank is true, then about:blank will get
>-   * the principal set up on it.
>-   *
>+   * the principal set up on it. If aForceOwner is true, the owner
>+   * will be set on the channel, even if the principal can be determined
>+   * from the channel.
>    * The return value is whether the principal was set up as the owner
>    * of the channel.
>    */
>   static bool SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
>                                 nsIChannel* aChannel,
>                                 nsIURI* aURI,
>-                                bool aSetUpForAboutBlank);
>+                                bool aSetUpForAboutBlank,
>+                                bool aForceOwner = false);
> 
>   static nsresult Btoa(const nsAString& aBinaryData,
>                        nsAString& aAsciiBase64String);
> 
>   static nsresult Atob(const nsAString& aAsciiString,
>                        nsAString& aBinaryData);
> 
>   /** If aJSArray is a Javascript array, this method iterates over its
>    *  elements and appends values to aRetVal as nsIAtoms.
>    *  @throw NS_ERROR_ILLEGAL_VALUE if aJSArray isn't a JS array.
>    */ 
>   static nsresult JSArrayToAtomArray(JSContext* aCx, const JS::Value& aJSArray,
>                                      nsCOMArray<nsIAtom>& aRetVal);
> 
>   /**
>    * Returns whether the input element passed in parameter has the autocomplete
>-   * functionnality enabled. It is taking into account the form owner.
>+   * functionality enabled. It is taking into account the form owner.
>    * NOTE: the caller has to make sure autocomplete makes sense for the
>    * element's type.
>    *
>    * @param aInput the input element to check. NOTE: aInput can't be null.
>    * @return whether the input element has autocomplete enabled.
>    */
>   static bool IsAutocompleteEnabled(nsIDOMHTMLInputElement* aInput);
> 
>diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
>--- a/content/base/public/nsIDocument.h
>+++ b/content/base/public/nsIDocument.h
>@@ -87,18 +87,18 @@ class Loader;
> 
> namespace dom {
> class Link;
> class Element;
> } // namespace dom
> } // namespace mozilla
> 
> #define NS_IDOCUMENT_IID \
>-{ 0x077dcff0, 0x400d, 0x4d3c, \
>-  { 0xbd, 0x4d, 0x5f, 0xd5, 0xe1, 0xa6, 0x63, 0x07 } }
>+{ 0x57fe44ae, 0x6656, 0x44b8, \
>+  { 0x8d, 0xc0, 0xfc, 0xa7, 0x43, 0x28, 0xbe, 0x86 } }
> 
> // Flag for AddStyleSheet().
> #define NS_STYLESHEET_FROM_CATALOG                (1 << 0)
> 
> // Enum for requesting a particular type of document when creating a doc
> enum DocumentFlavor {
>   DocumentFlavorLegacyGuess, // compat with old code until made HTML5-compliant
>   DocumentFlavorHTML, // HTMLDocument with HTMLness bit set to true
>@@ -426,17 +426,26 @@ public:
>    * callers are expected to take action as needed if they want this
>    * change to actually change anything immediately.
>    * @see nsBidiUtils.h
>    */
>   void SetBidiOptions(PRUint32 aBidiOptions)
>   {
>     mBidiOptions = aBidiOptions;
>   }
>-  
>+
>+  /**
>+   * Get the sandbox flags for this document.
>+   * @see nsSandboxFlags.h for the possible flags
>+   */
>+  PRUint32 SandboxFlags() const
>+  {
>+    return mSandboxFlags;
>+  }
>+
>   /**
>    * Access HTTP header data (this may also get set from other
>    * sources, like HTML META tags).
>    */
>   virtual void GetHeaderData(nsIAtom* aHeaderField, nsAString& aData) const = 0;
>   virtual void SetHeaderData(nsIAtom* aheaderField, const nsAString& aData) = 0;
> 
>   /**
>@@ -1841,16 +1850,21 @@ protected:
>   // If mIsStaticDocument is true, mOriginalDocument points to the original
>   // document.
>   nsCOMPtr<nsIDocument> mOriginalDocument;
> 
>   // The bidi options for this document.  What this bitfield means is
>   // defined in nsBidiUtils.h
>   PRUint32 mBidiOptions;
> 
>+  // The sandbox flags on the document. These reflect the value of the sandbox attribute of the
>+  // associated IFRAME or CSP-protectable content, if existent. These are set at load time and
>+  // are immutable - see nsSandboxFlags.h for the possible flags.
>+  PRUint32 mSandboxFlags;
>+
>   nsCString mContentLanguage;
> private:
>   nsCString mContentType;
> protected:
> 
>   // The document's security info
>   nsCOMPtr<nsISupports> mSecurityInfo;
> 
>diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
>--- a/content/base/src/nsContentUtils.cpp
>+++ b/content/base/src/nsContentUtils.cpp
>@@ -176,16 +176,17 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_
> 
> #include "nsWrapperCacheInlines.h"
> #include "nsIDOMDocumentType.h"
> #include "nsCharSeparatedTokenizer.h"
> 
> #include "nsICharsetDetector.h"
> #include "nsICharsetDetectionObserver.h"
> #include "nsIPlatformCharset.h"
>+#include "nsSandboxFlags.h"
> 
> extern "C" int MOZ_XMLTranslateEntity(const char* ptr, const char* end,
>                                       const char** next, PRUnichar* result);
> extern "C" int MOZ_XMLCheckQName(const char* ptr, const char* end,
>                                  int ns_aware, const char** colon);
> 
> using namespace mozilla::dom;
> using namespace mozilla::layers;
>@@ -882,16 +883,62 @@ nsContentUtils::GetParserService()
>     nsresult rv = CallGetService(kParserServiceCID, &sParserService);
>     if (NS_FAILED(rv)) {
>       sParserService = nsnull;
>     }
>   }
> 
>   return sParserService;
> }
>+/**
>+ * A helper function that parses a sandbox attribute (of an <iframe> or
>+ * a CSP directive) and converts it to the set of flags used internally.
>+ *
>+ * @param aAttribute    the value of the sandbox attribute
>+ * @return              the set of flags
>+ */
>+PRUint32
>+nsContentUtils::ParseSandboxAttributeToFlags(const nsAString& aSandboxAttrValue)
>+{
>+  // If there's a sandbox attribute at all (and there is if this is being
>+  // called), start off by setting all the restriction flags.
>+  PRUint32 out = SANDBOXED_NAVIGATION |
>+    SANDBOXED_TOPLEVEL_NAVIGATION |
>+    SANDBOXED_PLUGINS | SANDBOXED_ORIGIN |
>+    SANDBOXED_FORMS | SANDBOXED_SCRIPTS |
>+    SANDBOXED_AUTOMATIC_FEATURES;
>+
>+  if (!aSandboxAttrValue.IsEmpty()) {
>+    // The separator optional flag is used because the HTML5 spec says any
>+    // whitespace is ok as a separator, which is what this does.
>+    HTMLSplitOnSpacesTokenizer tokenizer(aSandboxAttrValue, ' ',
>+      nsCharSeparatedTokenizerTemplate<nsContentUtils::IsHTMLWhitespace>::SEPARATOR_OPTIONAL);
>+
>+    while (tokenizer.hasMoreTokens()) {
>+      nsDependentSubstring token = tokenizer.nextToken();
>+
>+      if (token.LowerCaseEqualsLiteral("allow-scripts")) {
>+        out &= ~SANDBOXED_SCRIPTS;
>+      } else if (token.LowerCaseEqualsLiteral("allow-same-origin")) {
>+        out &= ~SANDBOXED_ORIGIN;
>+      } else if (token.LowerCaseEqualsLiteral("allow-forms")) {
>+        out &= ~SANDBOXED_FORMS;
>+      } else if (token.LowerCaseEqualsLiteral("allow-scripts")) {
>+        // allow-scripts removes both SANDBOXED_SCRIPTS and
>+        // SANDBOXED_AUTOMATIC_FEATURES.
>+        out &= ~SANDBOXED_SCRIPTS;
>+        out &= ~SANDBOXED_AUTOMATIC_FEATURES;
>+      } else if (token.LowerCaseEqualsLiteral("allow-top-navigation")) {
>+        out &= ~SANDBOXED_TOPLEVEL_NAVIGATION;
>+      }
>+    }
>+  }
>+
>+  return out;
>+}
> 
> #ifdef MOZ_XTF
> nsIXTFService*
> nsContentUtils::GetXTFService()
> {
>   if (!sXTFService) {
>     nsresult rv = CallGetService(kXTFServiceCID, &sXTFService);
>     if (NS_FAILED(rv)) {
>@@ -6538,17 +6585,18 @@ nsContentUtils::URIInheritsSecurityConte
>                              aResult);
> }
> 
> // static
> bool
> nsContentUtils::SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
>                                   nsIChannel* aChannel,
>                                   nsIURI* aURI,
>-                                  bool aSetUpForAboutBlank)
>+                                  bool aSetUpForAboutBlank,
>+                                  bool aForceOwner)
> {
>   //
>   // Set the owner of the channel, but only for channels that can't
>   // provide their own security context.
>   //
>   // XXX: It seems wrong that the owner is ignored - even if one is
>   //      supplied) unless the URI is javascript or data or about:blank.
>   // XXX: If this is ever changed, check all callers for what owners
>@@ -6556,23 +6604,33 @@ nsContentUtils::SetUpChannelOwner(nsIPri
>   //      comments in nsDocShell::LoadURI where we fall back on
>   //      inheriting the owner if called from chrome.  That would be
>   //      very wrong if this code changed anything but channels that
>   //      can't provide their own security context!
>   //
>   //      (Currently chrome URIs set the owner when they are created!
>   //      So setting a NULL owner would be bad!)
>   //
>+  // If aForceOwner is true, the owner will be set, even for a channel that
>+  // can provide its own security context. This is used for the HTML5 IFRAME
>+  // sandbox attribute, so we can force the channel (and its document) to
>+  // explicitly have a null principal.
>   bool inherit;
>   // We expect URIInheritsSecurityContext to return success for an
>   // about:blank URI, so don't call NS_IsAboutBlank() if this call fails.
>   // This condition needs to match the one in nsDocShell::InternalLoad where
>   // we're checking for things that will use the owner.
>-  if (NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
>-      (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))) {
>+  if (aForceOwner || ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
>+      (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))))) {
>+    // Be certain that aForceOwner is only set for null principals
>+    if (aForceOwner) {
>+      nsCOMPtr<nsIURI> ownerURI;
>+      nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
>+      MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
>+    }
>     aChannel->SetOwner(aLoadingPrincipal);
>     return true;
>   }
> 
>   //
>   // file: uri special-casing
>   //
>   // If this is a file: load opened from another file: then it may need
>diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
>--- a/content/base/src/nsDocument.cpp
>+++ b/content/base/src/nsDocument.cpp
>@@ -2363,16 +2363,25 @@ nsDocument::StartDocumentLoad(const char
>     FindCharInReadable(';', semicolon, end);
>     SetContentTypeInternal(Substring(start, semicolon));
>   }
> 
>   RetrieveRelevantHeaders(aChannel);
> 
>   mChannel = aChannel;
> 
>+  // If this document is being loaded by a docshell, copy its sandbox flags
>+  // to the document. These are immutable after being set here.
>+  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(aContainer);
>+
>+  if (docShell) {
>+    nsresult rv = docShell->GetSandboxFlags(&mSandboxFlags);
>+    NS_ENSURE_SUCCESS(rv, rv);
>+  }
>+
>   nsresult rv = InitCSP();
>   NS_ENSURE_SUCCESS(rv, rv);
> 
>   return NS_OK;
> }
> 
> nsresult
> nsDocument::InitCSP()
>diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
>--- a/content/base/src/nsFrameLoader.cpp
>+++ b/content/base/src/nsFrameLoader.cpp
>@@ -77,16 +77,19 @@
> #include "mozilla/GuardObjects.h"
> #include "mozilla/Preferences.h"
> #include "mozilla/unused.h"
> #include "mozilla/dom/Element.h"
> #include "mozilla/layout/RenderFrameParent.h"
> 
> #include "jsapi.h"
> 
>+#include "nsHTMLIFrameElement.h"
>+#include "nsSandboxFlags.h"
>+
> using namespace mozilla;
> using namespace mozilla::dom;
> using namespace mozilla::layers;
> using namespace mozilla::layout;
> typedef FrameMetrics::ViewID ViewID;
> 
> class nsAsyncDocShellDestroyer : public nsRunnable
> {
>@@ -438,16 +441,47 @@ nsFrameLoader::ReallyStartLoadingInterna
>   // Just to be safe, recheck uri.
>   rv = CheckURILoad(mURIToLoad);
>   NS_ENSURE_SUCCESS(rv, rv);
> 
>   nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
>   mDocShell->CreateLoadInfo(getter_AddRefs(loadInfo));
>   NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
> 
>+  // Is this an <iframe> with a sandbox attribute or a parent which is
>+  // sandboxed ?
>+  nsHTMLIFrameElement* iframe =
>+    nsHTMLIFrameElement::FromContent(mOwnerContent);
>+
>+  PRUint32 sandboxFlags = 0;
>+
>+  if (iframe) {
>+    sandboxFlags = iframe->GetSandboxFlags();
>+
>+    // The OwnerDoc of an iframe node is the parent document of that <iframe>.
>+    PRUint32 parentSandboxFlags = iframe->OwnerDoc() ?
>+      iframe->OwnerDoc()->SandboxFlags() : 0;
>+
>+    if (sandboxFlags || parentSandboxFlags) {
>+      // The child can only add restrictions, not remove them.
>+      sandboxFlags |= parentSandboxFlags;
>+
>+      mDocShell->SetSandboxFlags(sandboxFlags);
>+
>+      // Set up the actual sandboxing for plugins as specified.
>+      if (sandboxFlags & SANDBOXED_PLUGINS) {
>+        mDocShell->SetAllowPlugins(false);
>+      }
>+    }
>+  }
>+
>+  // If this is an <iframe> and it's sandboxed with respect to origin
>+  // we will set it up with a null principal later in nsDocShell::DoURILoad.
>+  // We do it there to correctly sandbox content that was loaded into
>+  // the iframe via other methods than the src attribute.
>   // We'll use our principal, not that of the document loaded inside us.  This
>   // is very important; needed to prevent XSS attacks on documents loaded in
>   // subframes!
>   loadInfo->SetOwner(mOwnerContent->NodePrincipal());
> 
>   nsCOMPtr<nsIURI> referrer;
>   rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
>   NS_ENSURE_SUCCESS(rv, rv);
>diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
>--- a/content/base/src/nsGkAtomList.h
>+++ b/content/base/src/nsGkAtomList.h
>@@ -62,17 +62,21 @@ GK_ATOM(actuate, "actuate")
> GK_ATOM(address, "address")
> GK_ATOM(after, "after")
> GK_ATOM(after_end, "after_end")
> GK_ATOM(after_start, "after_start")
> GK_ATOM(align, "align")
> GK_ATOM(alink, "alink")
> GK_ATOM(all, "all")
> GK_ATOM(allowevents, "allowevents")
>+GK_ATOM(allowforms, "allow-forms")
> GK_ATOM(allownegativeassertions, "allownegativeassertions")
>+GK_ATOM(allowsameorigin, "allow-same-origin")
>+GK_ATOM(allowscripts, "allow-scripts")
>+GK_ATOM(allowtopnavigation, "allow-top-navigation")
> GK_ATOM(allowuntrusted, "allowuntrusted")
> GK_ATOM(alt, "alt")
> GK_ATOM(alternate, "alternate")
> GK_ATOM(always, "always")
> GK_ATOM(ancestor, "ancestor")
> GK_ATOM(ancestorOrSelf, "ancestor-or-self")
> GK_ATOM(_and, "and")
> GK_ATOM(any, "any")
>@@ -837,16 +841,17 @@ GK_ATOM(rowspan, "rowspan")
> GK_ATOM(rp, "rp")
> GK_ATOM(rt, "rt")
> GK_ATOM(rtl, "rtl")
> GK_ATOM(ruby, "ruby")
> GK_ATOM(rule, "rule")
> GK_ATOM(rules, "rules")
> GK_ATOM(s, "s")
> GK_ATOM(samp, "samp")
>+GK_ATOM(sandbox, "sandbox")
> GK_ATOM(sbattr, "sbattr")
> GK_ATOM(scale, "scale")
> GK_ATOM(scan, "scan")
> GK_ATOM(scheme, "scheme")
> GK_ATOM(scope, "scope")
> GK_ATOM(scoped, "scoped")
> GK_ATOM(screen, "screen")
> GK_ATOM(screenX, "screenX")
>diff --git a/content/base/src/nsSandboxFlags.h b/content/base/src/nsSandboxFlags.h
>new file mode 100644
>--- /dev/null
>+++ b/content/base/src/nsSandboxFlags.h
>@@ -0,0 +1,58 @@
>+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
>+/* This Source Code Form is subject to the terms of the Mozilla Public
>+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
>+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
>+
>+/*
>+ * Constant flags that describe how a document is sandboxed according to the
>+ * HTML5 spec.
>+ */
>+
>+#ifndef nsSandboxFlags_h___
>+#define nsSandboxFlags_h___
>+
>+/**
>+ * This flag prevents content from navigating browsing contexts other than
>+ * the sandboxed browsing context itself (or browsing contexts further
>+ * nested inside it), and the top-level browsing context.
>+ */
>+const unsigned long SANDBOXED_NAVIGATION  = 0x1;
>+
>+/**
>+ * This flag prevents content from navigating their top-level browsing
>+ * context.
>+ */
>+const unsigned long SANDBOXED_TOPLEVEL_NAVIGATION = 0x2;
>+
>+/**
>+ * This flag prevents content from instantiating plugins, whether using the
>+ * embed element, the object element, the applet element, or through
>+ * navigation of a nested browsing context, unless those plugins can be
>+ * secured.
>+ */
>+const unsigned long SANDBOXED_PLUGINS = 0x4;
>+
>+/**
>+ * This flag forces content into a unique origin, thus preventing it from
>+ * accessing other content from the same origin.
>+ * This flag also prevents script from reading from or writing to the
>+ * document.cookie IDL attribute, and blocks access to localStorage.
>+ */
>+const unsigned long SANDBOXED_ORIGIN = 0x8;
>+
>+/**
>+ * This flag blocks form submission.
>+ */
>+const unsigned long SANDBOXED_FORMS = 0x10;
>+
>+/**
>+ * This flag blocks script execution.
>+ */
>+const unsigned long SANDBOXED_SCRIPTS = 0x20;
>+
>+/**
>+ * This flag blocks features that trigger automatically, such as
>+ * automatically playing a video or automatically focusing a form control.
>+ */
>+const unsigned long SANDBOXED_AUTOMATIC_FEATURES = 0x40;
>+#endif
>diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
>--- a/content/base/src/nsScriptLoader.cpp
>+++ b/content/base/src/nsScriptLoader.cpp
>@@ -37,16 +37,17 @@
> #include "nsIContentSecurityPolicy.h"
> #include "prlog.h"
> #include "nsIChannelPolicy.h"
> #include "nsChannelPolicy.h"
> #include "nsCRT.h"
> #include "nsContentCreatorFunctions.h"
> #include "nsGenericElement.h"
> #include "nsCrossSiteListenerProxy.h"
>+#include "nsSandboxFlags.h"
> 
> #include "mozilla/FunctionTimer.h"
> #include "mozilla/CORSMode.h"
> 
> #ifdef PR_LOGGING
> static PRLogModuleInfo* gCspPRLog;
> #endif
> 
>@@ -272,16 +273,22 @@ nsScriptLoader::StartLoad(nsScriptLoadRe
>   if (!window) {
>     return NS_ERROR_NULL_POINTER;
>   }
> 
>   nsIDocShell *docshell = window->GetDocShell();
> 
>   nsCOMPtr<nsIInterfaceRequestor> prompter(do_QueryInterface(docshell));
> 
>+  // If this document is sandboxed without 'allow-scripts', abort.
>+  if (mDocument->SandboxFlags() & SANDBOXED_SCRIPTS) {
>+    // REVIEW : this probably isn't the right error..
>+    return NS_ERROR_DOM_SECURITY_ERR;
>+  }
>+
>   // check for a Content Security Policy to pass down to the channel
>   // that will be created to load the script
>   nsCOMPtr<nsIChannelPolicy> channelPolicy;
>   nsCOMPtr<nsIContentSecurityPolicy> csp;
>   rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
>   NS_ENSURE_SUCCESS(rv, rv);
>   if (csp) {
>     channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
>@@ -629,16 +636,21 @@ nsScriptLoader::ProcessScriptElement(nsI
>         "There can be only one parser-blocking script at a time");
>     NS_ASSERTION(mXSLTRequests.IsEmpty(),
>         "Parser-blocking scripts and XSLT scripts in the same doc!");
>     mParserBlockingRequest = request;
>     return true;
>   }
> 
>   // inline script
>+  // Is this document sandboxed without 'allow-scripts'?
>+  if (mDocument->SandboxFlags() & SANDBOXED_SCRIPTS) {
>+    return false;
>+  }
>+
>   nsCOMPtr<nsIContentSecurityPolicy> csp;
>   rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
>   NS_ENSURE_SUCCESS(rv, false);
> 
>   if (csp) {
>     PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader i ****with CSP****"));
>     bool inlineOK;
>     rv = csp->GetAllowsInlineScript(&inlineOK);
>diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
>--- a/content/events/src/nsEventListenerManager.cpp
>+++ b/content/events/src/nsEventListenerManager.cpp
>@@ -50,16 +50,17 @@
> #include "nsDOMJSUtils.h"
> #include "nsDOMScriptObjectHolder.h"
> #include "nsDataHashtable.h"
> #include "nsCOMArray.h"
> #include "nsEventListenerService.h"
> #include "nsIContentSecurityPolicy.h"
> #include "nsJSEnvironment.h"
> #include "xpcpublic.h"
>+#include "nsSandboxFlags.h"
> 
> using namespace mozilla::dom;
> using namespace mozilla::hal;
> 
> #define EVENT_TYPE_EQUALS( ls, type, userType ) \
>   (ls->mEventType == type && \
>   (ls->mEventType != NS_USER_DEFINED_EVENT || ls->mTypeAtom == userType))
> 
>@@ -561,16 +562,22 @@ nsEventListenerManager::AddScriptEventLi
>     // loaded as data.
>     return NS_OK;
>   }
> 
>   nsresult rv = NS_OK;
>   // return early preventing the event listener from being added
>   // 'doc' is fetched above
>   if (doc) {
>+    // Don't allow adding an event listener if the document is sandboxed
>+    // without 'allow-scripts'.
>+    if (doc->SandboxFlags() & SANDBOXED_SCRIPTS) {
>+      return NS_ERROR_DOM_SECURITY_ERR;
>+    }
>+
>     nsCOMPtr<nsIContentSecurityPolicy> csp;
>     rv = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
>     NS_ENSURE_SUCCESS(rv, rv);
> 
>     if (csp) {
>       bool inlineOK;
>       rv = csp->GetAllowsInlineScript(&inlineOK);
>       NS_ENSURE_SUCCESS(rv, rv);
>diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
>--- a/content/html/content/src/nsHTMLFormElement.cpp
>+++ b/content/html/content/src/nsHTMLFormElement.cpp
>@@ -48,16 +48,17 @@
> 
> #include "mozAutoDocUpdate.h"
> #include "nsIHTMLCollection.h"
> 
> #include "nsIConstraintValidation.h"
> 
> #include "nsIDOMHTMLButtonElement.h"
> #include "dombindings.h"
>+#include "nsSandboxFlags.h"
> 
> using namespace mozilla::dom;
> 
> static const int NS_FORM_CONTROL_LIST_HASHTABLE_SIZE = 16;
> 
> static const PRUint8 NS_FORM_AUTOCOMPLETE_ON  = 1;
> static const PRUint8 NS_FORM_AUTOCOMPLETE_OFF = 0;
> 
>@@ -648,17 +649,19 @@ nsHTMLFormElement::DoSubmitOrReset(nsEve
>     return DoReset();
>   }
> 
>   if (NS_FORM_SUBMIT == aMessage) {
>     // Don't submit if we're not in a document.
>     if (!doc) {
>       return NS_OK;
>     }
>-    return DoSubmit(aEvent);
>+    // Don't submit if we're in a sandboxed frame and form submit
>+    // is disabled.
>+    return (doc->SandboxFlags() & SANDBOXED_FORMS) ? NS_OK : DoSubmit(aEvent);
>   }
> 
>   MOZ_ASSERT(false);
>   return NS_OK;
> }
> 
> nsresult
> nsHTMLFormElement::DoReset()
>@@ -1649,16 +1652,24 @@ nsHTMLFormElement::CheckValidFormSubmiss
>    * TODO: the check for observer should be removed later when HTML5 Forms will
>    * be spread enough and authors will assume forms can't be submitted when
>    * invalid. See bug 587671.
>    */
> 
>   NS_ASSERTION(!HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate),
>                "We shouldn't be there if novalidate is set!");
> 
>+  // Don't do validation for a form submit done by a sandboxed document that
>+  // doesn't have 'allow-forms', the submit will have been blocked and the
>+  // HTML5 spec says we shouldn't validate in this case.
>+  nsIDocument* doc = GetCurrentDoc();
>+  if (doc && (doc->SandboxFlags() & SANDBOXED_FORMS)) {
>+      return true;
>+  }
>+
>   // When .submit() is called aEvent = nsnull so we can rely on that to know if
>   // we have to check the validity of the form.
>   nsCOMPtr<nsIObserverService> service =
>     mozilla::services::GetObserverService();
>   if (!service) {
>     NS_WARNING("No observer service available!");
>     return true;
>   }
>diff --git a/content/html/content/src/nsHTMLIFrameElement.cpp b/content/html/content/src/nsHTMLIFrameElement.cpp
>--- a/content/html/content/src/nsHTMLIFrameElement.cpp
>+++ b/content/html/content/src/nsHTMLIFrameElement.cpp
>@@ -1,24 +1,16 @@
> /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
> /* This Source Code Form is subject to the terms of the Mozilla Public
>  * License, v. 2.0. If a copy of the MPL was not distributed with this
>  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
> 
> #include "mozilla/Util.h"
> 
> #include "nsHTMLIFrameElement.h"
>-#include "nsIDOMDocument.h"
>-#include "nsIDOMSVGDocument.h"
>-#include "nsGkAtoms.h"
>-#include "nsIDocument.h"
>-#include "nsMappedAttributes.h"
>-#include "nsDOMError.h"
>-#include "nsRuleData.h"
>-#include "nsStyleConsts.h"
> 
> using namespace mozilla;
> using namespace mozilla::dom;
> 
> NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(IFrame)
> 
> nsHTMLIFrameElement::nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
>                                          FromParser aFromParser)
>@@ -53,16 +45,17 @@ NS_IMPL_STRING_ATTR(nsHTMLIFrameElement,
> NS_IMPL_URI_ATTR(nsHTMLIFrameElement, LongDesc, longdesc)
> NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, MarginHeight, marginheight)
> NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, MarginWidth, marginwidth)
> NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Name, name)
> NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Scrolling, scrolling)
> NS_IMPL_URI_ATTR(nsHTMLIFrameElement, Src, src)
> NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Width, width)
> NS_IMPL_BOOL_ATTR(nsHTMLIFrameElement, MozAllowFullScreen, mozallowfullscreen)
>+NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Sandbox, sandbox)
> 
> void
> nsHTMLIFrameElement::GetItemValueText(nsAString& aValue)
> {
>   GetSrc(aValue);
> }
> 
> void
>@@ -202,8 +195,37 @@ nsHTMLIFrameElement::IsAttributeMapped(c
> 
> 
> nsMapRuleToAttributesFunc
> nsHTMLIFrameElement::GetAttributeMappingFunction() const
> {
>   return &MapAttributesIntoRule;
> }
> 
>+nsresult
>+nsHTMLIFrameElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
>+                                    const nsAttrValue* aValue,
>+                                    bool aNotify)
>+{
>+  if (aName == nsGkAtoms::sandbox && aNameSpaceID == kNameSpaceID_None) {
>+    // Parse the new value of the sandbox attribute, and if we have a docshell
>+    // set its sandbox flags appropriately.
>+    if (mFrameLoader) {
>+      nsCOMPtr<nsIDocShell> docshell = mFrameLoader->GetExistingDocShell();
>+
>+      if (docshell) {
>+        PRUint32 newFlags = 0;
>+        // If a NULL aValue is passed in, we want to clear the sandbox flags
>+        // which we will do by setting them to 0.
>+        if (aValue) {
>+          nsAutoString strValue;
>+          aValue->ToString(strValue);
>+          newFlags = nsContentUtils::ParseSandboxAttributeToFlags(
>+            strValue);
>+        }
>+        docshell->SetSandboxFlags(newFlags);
>+      }
>+    }
>+  }
>+  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue,
>+                                            aNotify);
>+
>+}
>diff --git a/content/html/content/src/nsHTMLIFrameElement.h b/content/html/content/src/nsHTMLIFrameElement.h
>--- a/content/html/content/src/nsHTMLIFrameElement.h
>+++ b/content/html/content/src/nsHTMLIFrameElement.h
>@@ -1,16 +1,24 @@
> /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
> /* This Source Code Form is subject to the terms of the Mozilla Public
>  * License, v. 2.0. If a copy of the MPL was not distributed with this
>  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
> 
> #include "nsGenericHTMLFrameElement.h"
> #include "nsIDOMHTMLIFrameElement.h"
> #include "nsIDOMGetSVGDocument.h"
>+#include "nsIDOMSVGDocument.h"
>+#include "nsGkAtoms.h"
>+#include "nsIDocument.h"
>+#include "nsMappedAttributes.h"
>+#include "nsDOMError.h"
>+#include "nsRuleData.h"
>+#include "nsStyleConsts.h"
>+#include "nsContentUtils.h"
> 
> class nsHTMLIFrameElement : public nsGenericHTMLFrameElement
>                           , public nsIDOMHTMLIFrameElement
>                           , public nsIDOMGetSVGDocument
> {
> public:
>   nsHTMLIFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
>                       mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
>@@ -41,12 +49,36 @@ public:
>                                 nsAttrValue& aResult);
>   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
>   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
> 
>   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
>   virtual nsXPCClassInfo* GetClassInfo();
>   virtual nsIDOMNode* AsDOMNode() { return this; }
> 
>+  virtual nsresult AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
>+                                const nsAttrValue* aValue,
>+                                bool aNotify);
>+
>+  PRUint32 GetSandboxFlags()
>+  {
>+    nsAutoString sandboxAttr;
>+
>+    if (GetAttr(kNameSpaceID_None, nsGkAtoms::sandbox, sandboxAttr)) {
>+      return nsContentUtils::ParseSandboxAttributeToFlags(sandboxAttr);
>+    }
>+
>+    // No sandbox attribute, no sandbox flags.
>+    return 0;
>+  }
>+
>+  static nsHTMLIFrameElement* FromContent(nsIContent *aContent)
>+  {
>+    if (aContent->IsHTML(nsGkAtoms::iframe)) {
>+      return static_cast<nsHTMLIFrameElement*>(aContent);
>+    }
>+    return nsnull;
>+  }
>+
> protected:
>   virtual void GetItemValueText(nsAString& text);
>   virtual void SetItemValueText(const nsAString& text);
> };
>diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
>--- a/content/html/document/src/nsHTMLDocument.cpp
>+++ b/content/html/document/src/nsHTMLDocument.cpp
>@@ -97,16 +97,17 @@
> #include "prprf.h"
> #include "mozilla/dom/Element.h"
> #include "mozilla/Preferences.h"
> #include "nsMimeTypes.h"
> #include "nsIRequest.h"
> #include "nsHtml5TreeOpExecutor.h"
> #include "nsHtml5Parser.h"
> #include "nsIDOMJSWindow.h"
>+#include "nsSandboxFlags.h"
> 
> using namespace mozilla;
> using namespace mozilla::dom;
> 
> #define NS_MAX_DOCUMENT_WRITE_DEPTH 20
> 
> #include "prmem.h"
> #include "prtime.h"
>@@ -1215,16 +1216,22 @@ nsHTMLDocument::GetCookie(nsAString& aCo
> {
>   aCookie.Truncate(); // clear current cookie in case service fails;
>                       // no cookie isn't an error condition.
> 
>   if (mDisableCookieAccess) {
>     return NS_OK;
>   }
> 
>+  // If the document's sandboxed origin flag is set, access to read cookies
>+  // is prohibited.
>+  if (mSandboxFlags & SANDBOXED_ORIGIN) {
>+    return NS_ERROR_DOM_SECURITY_ERR;
>+  }
>+  
>   // not having a cookie service isn't an error
>   nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
>   if (service) {
>     // Get a URI from the document principal. We use the original
>     // codebase in case the codebase was changed by SetDomain
>     nsCOMPtr<nsIURI> codebaseURI;
>     NodePrincipal()->GetURI(getter_AddRefs(codebaseURI));
> 
>@@ -1245,16 +1252,22 @@ nsHTMLDocument::GetCookie(nsAString& aCo
> 
> NS_IMETHODIMP
> nsHTMLDocument::SetCookie(const nsAString& aCookie)
> {
>   if (mDisableCookieAccess) {
>     return NS_OK;
>   }
> 
>+  // If the document's sandboxed origin flag is set, access to write cookies
>+  // is prohibited.
>+  if (mSandboxFlags & SANDBOXED_ORIGIN) {
>+    return NS_ERROR_DOM_SECURITY_ERR;
>+  }
>+
>   // not having a cookie service isn't an error
>   nsCOMPtr<nsICookieService> service = do_GetService(NS_COOKIESERVICE_CONTRACTID);
>   if (service && mDocumentURI) {
>     nsCOMPtr<nsIPrompt> prompt;
>     nsCOMPtr<nsPIDOMWindow> window = GetWindow();
>     if (window) {
>       window->GetPrompter(getter_AddRefs(prompt));
>     }
>diff --git a/docshell/base/Makefile.in b/docshell/base/Makefile.in
>--- a/docshell/base/Makefile.in
>+++ b/docshell/base/Makefile.in
>@@ -85,9 +85,10 @@ include $(topsrcdir)/config/config.mk
> include $(topsrcdir)/ipc/chromium/chromium-config.mk
> include $(topsrcdir)/config/rules.mk
> 
> LOCAL_INCLUDES += \
>   -I$(srcdir)/../shistory/src \
>   -I$(topsrcdir)/dom/base \
>   -I$(topsrcdir)/layout/base \
>   -I$(topsrcdir)/xpcom/ds \
>+  -I$(topsrcdir)/content/base/src \
>   $(NULL)
>diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
>--- a/docshell/base/nsDocShell.cpp
>+++ b/docshell/base/nsDocShell.cpp
>@@ -177,16 +177,17 @@
> #include "nsIWebBrowserPrint.h"
> #endif
> 
> #include "nsPluginError.h"
> #include "nsContentUtils.h"
> #include "nsContentErrors.h"
> #include "nsIChannelPolicy.h"
> #include "nsIContentSecurityPolicy.h"
>+#include "nsSandboxFlags.h"
> 
> #include "nsXULAppAPI.h"
> 
> #include "nsDOMNavigationTiming.h"
> #include "nsITimedChannel.h"
> #include "mozilla/StartupTimeline.h"
> #include "nsIFrameMessageManager.h"
> 
>@@ -728,16 +729,17 @@ nsDocShell::nsDocShell():
>     mBusyFlags(BUSY_FLAGS_NONE),
>     mAppType(nsIDocShell::APP_TYPE_UNKNOWN),
>     mLoadType(0),
>     mMarginWidth(-1),
>     mMarginHeight(-1),
>     mItemType(typeContent),
>     mPreviousTransIndex(-1),
>     mLoadedTransIndex(-1),
>+    mSandboxFlags(0),
>     mCreated(false),
>     mAllowSubframes(true),
>     mAllowPlugins(true),
>     mAllowJavascript(true),
>     mAllowMetaRedirects(true),
>     mAllowImages(true),
>     mAllowDNSPrefetch(true),
>     mAllowWindowControl(true),
>@@ -2972,16 +2974,73 @@ nsDocShell::FindItemWithName(const PRUni
>             foundItem = nsnull;
>         }
> 
>         if (foundItem) {
>             // We return foundItem here even if it's not an active
>             // item since all the names we've dealt with so far are
>             // special cases that we won't bother looking for further.
> 
>+            // If our document is sandboxed, we need to do some extra checks.
>+            PRUint32 sandboxFlags = 0;
>+
>+            nsCOMPtr<nsIDocument> doc = do_GetInterface(aOriginalRequestor);
>+
>+            if (doc) {
>+                sandboxFlags = doc->SandboxFlags();
>+            }
>+
>+            if (sandboxFlags) {
>+                nsCOMPtr<nsIDocShellTreeItem> root;
>+                GetSameTypeRootTreeItem(getter_AddRefs(root));
>+
>+                // Is the found item not a top level browsing context and not ourself ?
>+                nsCOMPtr<nsIDocShellTreeItem> selfAsItem = static_cast<nsIDocShellTreeItem *>(this);
>+                if (foundItem != root && foundItem != selfAsItem) {
>+                    // Are we an ancestor of the foundItem ?
>+                    bool isAncestor = false;
>+
>+                    nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
>+                    GetSameTypeParent(getter_AddRefs(parentAsItem));
>+
>+                    while (parentAsItem) {
>+                        nsCOMPtr<nsIDocShellTreeItem> tmp;
>+                        parentAsItem->GetParent(getter_AddRefs(tmp));
>+
>+                        if (tmp && tmp == selfAsItem) {
>+                            isAncestor = true;
>+                            break;
>+                        }
>+                        parentAsItem = tmp;
>+                    }
>+
>+                    if (!isAncestor) {
>+                        // No, we are not an ancestor and our document is
>+                        // sandboxed, we can't allow this.
>+                        foundItem = nsnull;
>+                    }
>+                } else {
>+                    // Top level browsing context - is it an ancestor of ours ?
>+                    nsCOMPtr<nsIDocShellTreeItem> tmp;
>+                    GetSameTypeParent(getter_AddRefs(tmp));
>+
>+                    while (tmp) {
>+                        if (tmp && tmp == foundItem) {
>+                            // This is an ancestor, and we are sandboxed.
>+                            // Unless allow-top-navigation is set, we can't allow this.
>+                            if (sandboxFlags & SANDBOXED_TOPLEVEL_NAVIGATION) {
>+                              foundItem = nsnull;
>+                            }
>+                            break;
>+                        }
>+                        tmp->GetParent(getter_AddRefs(tmp));
>+                    }
>+                }
>+            }
>+
>             foundItem.swap(*_retval);
>             return NS_OK;
>         }
>     }
> 
>     // Keep looking
>         
>     // First we check our name.
>@@ -5012,16 +5071,30 @@ nsDocShell::SetIsAppTab(bool aIsAppTab)
> NS_IMETHODIMP
> nsDocShell::GetIsAppTab(bool *aIsAppTab)
> {
>   *aIsAppTab = mIsAppTab;
>   return NS_OK;
> }
> 
> NS_IMETHODIMP
>+nsDocShell::SetSandboxFlags(PRUint32 aSandboxFlags)
>+{
>+    mSandboxFlags = aSandboxFlags;
>+    return NS_OK;
>+}
>+
>+NS_IMETHODIMP
>+nsDocShell::GetSandboxFlags(PRUint32  *aSandboxFlags)
>+{
>+    *aSandboxFlags = mSandboxFlags;
>+    return NS_OK;
>+}
>+
>+NS_IMETHODIMP
> nsDocShell::SetVisibility(bool aVisibility)
> {
>     if (!mContentViewer)
>         return NS_OK;
>     if (aVisibility) {
>         mContentViewer->Show();
>     }
>     else {
>@@ -8250,16 +8323,29 @@ nsDocShell::InternalLoad(nsIURI * aURI,
>         nsCOMPtr<nsIDocShellTreeItem> targetItem;
>         FindItemWithName(aWindowTarget, nsnull, this,
>                          getter_AddRefs(targetItem));
> 
>         nsCOMPtr<nsIDocShell> targetDocShell = do_QueryInterface(targetItem);
>         
>         bool isNewWindow = false;
>         if (!targetDocShell) {
>+            // If the docshell's document is sandboxed and was trying to
>+            // navigate/load a frame it wasn't allowed to access, the
>+            // FindItemWithName above will have returned null for the target
>+            // item - we don't want to actually open a new window in this case
>+            // though. Check if we are sandboxed and bail out here if so.
>+            NS_ENSURE_TRUE(mContentViewer, NS_ERROR_FAILURE);
>+            nsIDocument* doc = mContentViewer->GetDocument();
>+            PRUint32 sandboxFlags = 0;
>+            sandboxFlags = doc->SandboxFlags();
>+            if (sandboxFlags & SANDBOXED_NAVIGATION) {
>+                return NS_ERROR_FAILURE;
>+            }
>+
>             nsCOMPtr<nsIDOMWindow> win =
>                 do_GetInterface(GetAsSupports(this));
>             NS_ENSURE_TRUE(win, NS_ERROR_NOT_AVAILABLE);
> 
>             nsDependentString name(aWindowTarget);
>             nsCOMPtr<nsIDOMWindow> newWin;
>             rv = win->Open(EmptyString(), // URL to load
>                            name,          // window name
>@@ -9061,18 +9147,31 @@ nsDocShell::DoURILoad(nsIURI * aURI,
>         }
>         // Set the referrer explicitly
>         if (aReferrerURI && aSendReferrer) {
>             // Referrer is currenly only set for link clicks here.
>             httpChannel->SetReferrer(aReferrerURI);
>         }
>     }
> 
>-    nsCOMPtr<nsIPrincipal> ownerPrincipal(do_QueryInterface(aOwner));
>-    nsContentUtils::SetUpChannelOwner(ownerPrincipal, channel, aURI, true);
>+    nsCOMPtr<nsIPrincipal> ownerPrincipal;
>+
>+    // If the content being loaded should be sandboxed with respect to origin
>+    // we need to create a new null principal here, and then tell
>+    // nsContentUtils::SetUpChannelOwner to force it to be set as the
>+    // channel owner.
>+    if (mSandboxFlags & SANDBOXED_ORIGIN) {
>+        ownerPrincipal = do_CreateInstance("@mozilla.org/nullprincipal;1");
>+    } else {
>+        // Not sandboxed - we allow the content to assume its natural owner.
>+        ownerPrincipal = do_QueryInterface(aOwner);
>+    }
>+
>+    nsContentUtils::SetUpChannelOwner(ownerPrincipal, channel, aURI, true,
>+                                      (mSandboxFlags & SANDBOXED_ORIGIN));
> 
>     nsCOMPtr<nsIScriptChannel> scriptChannel = do_QueryInterface(channel);
>     if (scriptChannel) {
>         // Allow execution against our context if the principals match
>         scriptChannel->
>             SetExecutionPolicy(nsIScriptChannel::EXECUTE_NORMAL);
>     }
> 
>diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
>--- a/docshell/base/nsDocShell.h
>+++ b/docshell/base/nsDocShell.h
>@@ -755,16 +755,18 @@ protected:
>     // Create() is called, the type is not expected to change.
>     PRInt32                    mItemType;
> 
>     // Index into the SHTransaction list, indicating the previous and current
>     // transaction at the time that this DocShell begins to load
>     PRInt32                    mPreviousTransIndex;
>     PRInt32                    mLoadedTransIndex;
> 
>+    PRUint32                   mSandboxFlags;
>+
>     bool                       mCreated;
>     bool                       mAllowSubframes;
>     bool                       mAllowPlugins;
>     bool                       mAllowJavascript;
>     bool                       mAllowMetaRedirects;
>     bool                       mAllowImages;
>     bool                       mAllowDNSPrefetch;
>     bool                       mAllowWindowControl;
>diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
>--- a/docshell/base/nsIDocShell.idl
>+++ b/docshell/base/nsIDocShell.idl
>@@ -34,17 +34,17 @@ interface nsISHEntry;
> interface nsILayoutHistoryState;
> interface nsISecureBrowserUI;
> interface nsIDOMStorage;
> interface nsIPrincipal;
> interface nsIWebBrowserPrint;
> interface nsIVariant;
> interface nsIPrivacyTransitionObserver;
> 
>-[scriptable, uuid(6f60ac96-fa2c-41a5-92b4-29aaadbd7a7b)]
>+[scriptable, uuid(9b283337-097d-4fa8-a2da-916318eaf828)]
> interface nsIDocShell : nsISupports
> {
>   /**
>    * Loads a given URI.  This will give priority to loading the requested URI
>    * in the object implementing	this interface.  If it can't be loaded here
>    * however, the URL dispatcher will go through its normal process of content
>    * loading.
>    *
>@@ -588,9 +588,23 @@ interface nsIDocShell : nsISupports
>    */
>   attribute bool isBrowserFrame;
> 
>   /*
>    * Is this docshell contained in an <iframe mozbrowser>, either directly or
>    * indirectly?
>    */
>   readonly attribute bool containedInBrowserFrame;
>+
>+  /**
>+   * The sandbox flags on the docshell. These reflect the value of the sandbox
>+   * attribute of the associated IFRAME or CSP-protectable content, if
>+   * existent. See the HTML5 spec for more details.
>+   * These flags on the docshell reflect the current state of the sandbox
>+   * attribute, which is modifiable. They are only used when loading new
>+   * content, sandbox flags are also immutably set on the document when it is
>+   * loaded.
>+   * The sandbox flags of a document depend on the sandbox flags on its
>+   * docshell and of its parent document, if any.
>+   * See nsSandboxFlags.h for the possible flags.
>+   */
>+  attribute unsigned long sandboxFlags;
> };
>diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
>--- a/dom/base/nsGlobalWindow.cpp
>+++ b/dom/base/nsGlobalWindow.cpp
>@@ -213,16 +213,17 @@
> #include "nsRefreshDriver.h"
> #include "mozAutoDocUpdate.h"
> 
> #include "mozilla/Telemetry.h"
> #include "nsLocation.h"
> #include "nsWrapperCacheInlines.h"
> #include "nsDOMEventTargetHelper.h"
> #include "nsIAppsService.h"
>+#include "nsSandboxFlags.h"
> 
> #ifdef ANDROID
> #include <android/log.h>
> #endif
> 
> #ifdef PR_LOGGING
> static PRLogModuleInfo* gDOMLeakPRLog;
> #endif
>@@ -8135,16 +8136,22 @@ nsGlobalWindow::GetSessionStorage(nsIDOM
>   if (!mSessionStorage) {
>     *aSessionStorage = nsnull;
> 
>     nsString documentURI;
>     if (mDocument) {
>       mDocument->GetDocumentURI(documentURI);
>     }
> 
>+    // If the document has the sandboxed origin flag set
>+    // don't allow access to localStorage.
>+    if (mDoc && (mDoc->SandboxFlags() & SANDBOXED_ORIGIN)) {
>+      return NS_ERROR_DOM_SECURITY_ERR;
>+    }
>+
>     nsresult rv = docShell->GetSessionStorageForPrincipal(principal,
>                                                           documentURI,
>                                                           true,
>                                                           getter_AddRefs(mSessionStorage));
>     NS_ENSURE_SUCCESS(rv, rv);
> 
> #ifdef PR_LOGGING
>     if (PR_LOG_TEST(gDOMLeakPRLog, PR_LOG_DEBUG)) {
>@@ -8200,16 +8207,22 @@ nsGlobalWindow::GetLocalStorage(nsIDOMSt
>       do_GetService("@mozilla.org/dom/storagemanager;1", &rv);
>     NS_ENSURE_SUCCESS(rv, rv);
> 
>     nsString documentURI;
>     if (mDocument) {
>       mDocument->GetDocumentURI(documentURI);
>     }
> 
>+    // If the document has the sandboxed origin flag set
>+    // don't allow access to localStorage.
>+    if (mDoc && (mDoc->SandboxFlags() & SANDBOXED_ORIGIN)) {
>+      return NS_ERROR_DOM_SECURITY_ERR;
>+    }
>+
>     nsIDocShell* docShell = GetDocShell();
>     nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(docShell);
> 
>     rv = storageManager->GetLocalStorageForPrincipal(principal,
>                                                      documentURI,
>                                                      loadContext && loadContext->UsePrivateBrowsing(),
>                                                      getter_AddRefs(mLocalStorage));
>     NS_ENSURE_SUCCESS(rv, rv);
>diff --git a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
>--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
>+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
>@@ -11,32 +11,32 @@
>  *
>  * This interface is trying to follow the DOM Level 2 HTML specification:
>  * http://www.w3.org/TR/DOM-Level-2-HTML/
>  *
>  * with changes from the work-in-progress WHATWG HTML specification:
>  * http://www.whatwg.org/specs/web-apps/current-work/
>  */
> 
>-[scriptable, uuid(97E4F0E1-BD27-40EC-9287-5634DAF15B73)]
>+[scriptable, uuid(52f6244b-b1f5-4f4c-8ff3-7e146316f411)]
> interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
> {
>            attribute DOMString        align;
>            attribute DOMString        frameBorder;
>            attribute DOMString        height;
>            attribute DOMString        longDesc;
>            attribute DOMString        marginHeight;
>            attribute DOMString        marginWidth;
>            attribute DOMString        name;
>            attribute DOMString        scrolling;
>            attribute DOMString        src;
>            attribute DOMString        width;
>   // Introduced in DOM Level 2:
>   readonly attribute nsIDOMDocument   contentDocument;
>   readonly attribute nsIDOMWindow     contentWindow;
> 
>-
>+           attribute DOMString        sandbox;
>   // Mozilla extensions
>   // iframe elements require the mozAllowFullScreen attribute to be present
>   // if they're to allow content in the sub document to go into DOM full-screen
>   // mode. See https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI
>            attribute boolean          mozAllowFullScreen;
> };
>diff --git a/dom/src/jsurl/Makefile.in b/dom/src/jsurl/Makefile.in
>--- a/dom/src/jsurl/Makefile.in
>+++ b/dom/src/jsurl/Makefile.in
>@@ -25,16 +25,17 @@ XPIDLSRCS	= \
> CPPSRCS		= nsJSProtocolHandler.cpp
> 
> EXPORTS		= $(srcdir)/nsJSProtocolHandler.h
> 
> LOCAL_INCLUDES += \
> 		-I$(srcdir) \
> 		-I$(topsrcdir)/dom/base \
> 		-I$(topsrcdir)/netwerk/base/src \
>+		-I$(topsrcdir)/content/base/src \
> 
> ifdef BUILD_DEBUG_GC
> DEFINES		+= -DDEBUG_GC
> endif
> 
> DIRS            = $(NULL)
> TEST_DIRS += test
> 
>diff --git a/dom/src/jsurl/nsJSProtocolHandler.cpp b/dom/src/jsurl/nsJSProtocolHandler.cpp
>--- a/dom/src/jsurl/nsJSProtocolHandler.cpp
>+++ b/dom/src/jsurl/nsJSProtocolHandler.cpp
>@@ -40,16 +40,17 @@
> #include "nsThreadUtils.h"
> #include "nsIJSContextStack.h"
> #include "nsIScriptChannel.h"
> #include "nsIDocument.h"
> #include "nsIObjectInputStream.h"
> #include "nsIObjectOutputStream.h"
> #include "nsIWritablePropertyBag2.h"
> #include "nsIContentSecurityPolicy.h"
>+#include "nsSandboxFlags.h"
> 
> static NS_DEFINE_CID(kJSURICID, NS_JSURI_CID);
> 
> class nsJSThunk : public nsIInputStream
> {
> public:
>     nsJSThunk();
> 
>@@ -186,16 +187,28 @@ nsresult nsJSThunk::EvaluateScript(nsICh
>     // Get the global object we should be running on.
>     nsIScriptGlobalObject* global = GetGlobalObject(aChannel);
>     if (!global) {
>         return NS_ERROR_FAILURE;
>     }
> 
>     nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(global));
> 
>+    // Sandboxed document check: javascript: URI's are disabled
>+    // in a sandboxed document unless 'allow-scripts' was specified
>+
>+    // REVIEW - it seems like the original inner window would be the one
>+    // that will execute the javascript with its principal - is this
>+    // assumption correct ?? (and is GetExtantDocument() the right way
>+    // to get the right document ??
>+    nsCOMPtr<nsIDocument> doc = do_QueryInterface(aOriginalInnerWindow->GetExtantDocument());
>+    if (doc && (doc->SandboxFlags() & SANDBOXED_SCRIPTS)) {
>+      return NS_ERROR_DOM_RETVAL_UNDEFINED;
>+    }
>+
>     // Push our popup control state
>     nsAutoPopupStatePusher popupStatePusher(win, aPopupState);
> 
>     // Make sure we still have the same inner window as we used to.
>     nsPIDOMWindow *innerWin = win->GetCurrentInnerWindow();
> 
>     if (innerWin != aOriginalInnerWindow) {
>         return NS_ERROR_UNEXPECTED;
>diff --git a/embedding/components/windowwatcher/src/Makefile.in b/embedding/components/windowwatcher/src/Makefile.in
>--- a/embedding/components/windowwatcher/src/Makefile.in
>+++ b/embedding/components/windowwatcher/src/Makefile.in
>@@ -24,11 +24,12 @@ CPPSRCS		+= nsDialogParamBlock.cpp \
> 		   $(NULL)
> endif
> 
> # we don't want the shared lib, but we want to force the creation of a
> # static lib.
> FORCE_STATIC_LIB = 1
> 
> # For nsJSUtils
>-LOCAL_INCLUDES += -I$(topsrcdir)/dom/base
>+LOCAL_INCLUDES += -I$(topsrcdir)/dom/base \
>+		  -I$(topsrcdir)/content/base/src \
> 
> include $(topsrcdir)/config/rules.mk
>diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
>--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
>+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
>@@ -53,16 +53,17 @@
> #include "nsPIDOMStorage.h"
> #include "nsIWidget.h"
> #include "nsFocusManager.h"
> #include "nsIPresShell.h"
> #include "nsPresContext.h"
> #include "nsContentUtils.h"
> #include "nsIPrefBranch.h"
> #include "nsIPrefService.h"
>+#include "nsSandboxFlags.h"
> 
> #ifdef USEWEAKREFS
> #include "nsIWeakReference.h"
> #endif
> 
> using namespace mozilla;
> 
> static const char *sJSStackContractID="@mozilla.org/js/xpc/ContextStack;1";
>@@ -570,16 +571,33 @@ nsWindowWatcher::OpenWindowJSInternal(ns
>   }
> 
>   if (!newDocShellItem) {
>     // We're going to either open up a new window ourselves or ask a
>     // nsIWindowProvider for one.  In either case, we'll want to set the right
>     // name on it.
>     windowNeedsName = true;
> 
>+    // If the parent trying to open a new window is sandboxed,
>+    // this is not allowed and we fail here.
>+    if (aParent) {
>+      nsCOMPtr<nsIDOMDocument> domdoc;
>+      aParent->GetDocument(getter_AddRefs(domdoc));
>+      nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);
>+
>+      if (doc) {
>+        PRUint32 sandboxFlags = 0;
>+        sandboxFlags = doc->SandboxFlags();
>+
>+        if (sandboxFlags & SANDBOXED_NAVIGATION) {
>+          return NS_ERROR_FAILURE;
>+        }
>+      }
>+    }
>+
>     // Now check whether it's ok to ask a window provider for a window.  Don't
>     // do it if we're opening a dialog or if our parent is a chrome window or
>     // if we're opening something that has modal, dialog, or chrome flags set.
>     nsCOMPtr<nsIDOMChromeWindow> chromeWin = do_QueryInterface(aParent);
>     if (!aDialog && !chromeWin &&
>         !(chromeFlags & (nsIWebBrowserChrome::CHROME_MODAL         |
>                          nsIWebBrowserChrome::CHROME_OPENAS_DIALOG | 
>                          nsIWebBrowserChrome::CHROME_OPENAS_CHROME))) {

Actions: View | Diff | Review

Attachments on bug 341604: 574383 | 574480 | 575603 | 575617 | 578433 | 578799 | 585561 | 585605 | 589638 | 594862 | 596206 | 596250 | 596886 | 597213 | 600577 | 603453 | 603514 | 603903 | 604565 | 604572 | 605220 | 606238 | 606927 | 606928 | 607321 | 609874 | 610203 | 611076 | 612006 | 612287 | 612372 | 612425 | 613831 | 615917 | 615924 | 616023 | 616024 | 616395 | 616405 | 616649 | 617117 | 617118 | 617129 | 621201 | 621203 | 621205 | 621221 | 624214 | 624217 | 624220 | 624484 | 624522 | 625316 | 625329 | 630331 | 633207 | 633209 | 633639 | 633652 | 633731 | 633735 | 634584 | 634620 | 638540 | 638541 | 638547 | 638823 | 639552 | 642024 | 643055 | 643557 | 646296 | 648903 | 649004 | 649005 | 649006 | 650371 | 650373 | 650374 | 650376 | 650377 | 650378 | 650379 | 650381 | 650383 | 650384 | 650386