Attachment #713440 for bug #838692

Attachment #713440: Named Sandboxed Navigation fix to nsDocShell for bug #838692

View | Details | Raw Unified | Return to bug 838692
Collapse All | Expand All





    NS_ENSURE_ARG_POINTER(_retval);

    // If we don't find one, we return NS_OK and a null result
    *_retval = nullptr;

    if (!*aName)
        return NS_OK;

    if (aRequestor) {
        // We are being called as part of the recursive search just hand
        // straight off to the search by actual name function.
        return DoFindItemWithName(aName, aRequestor, aOriginalRequestor,
                                  _retval);
    } else {

        // This is the entry point into the target-finding algorithm.  Check
        // for special names.  This should only be done once, hence the check
        // for a null aRequestor.

        nsCOMPtr<nsIDocShellTreeItem> foundItem;
        nsDependentString name(aName);
        if (name.LowerCaseEqualsLiteral("_self")) {
            foundItem = this;
        }
        else if (name.LowerCaseEqualsLiteral("_blank"))
        {
            // Just return null.  Caller must handle creating a new window with
            // a blank name himself.

                // Note: _content should always exist.  If we don't have one
                // hanging off the treeowner, just create a named window....
                // so don't return here, in case we did that and can now find
                // it.                
                // XXXbz should we be using |root| instead of creating
                // a new window?
            }
#endif
        } else {
            // Do the search for item by an actual name.
            DoFindItemWithName(aName, aRequestor, aOriginalRequestor,
                               getter_AddRefs(foundItem));
        }

        if (foundItem && !CanAccessItem(foundItem, aOriginalRequestor)) {
            foundItem = nullptr;
        }

        // DoFindItemWithName only returns active items and we don't check if
        // the item is active for the special cases.
        if (foundItem) {
            // We return foundItem here even if it's not an active
            // item since all the names we've dealt with so far are
            // special cases that we won't bother looking for further.

            // If our document is sandboxed, we need to do some extra checks.
            uint32_t sandboxFlags = 0;

            nsCOMPtr<nsIDocument> doc = do_GetInterface(aOriginalRequestor);

            if (doc) {
                sandboxFlags = doc->GetSandboxFlags();


                // Is the found item not a top level browsing context and not ourself ?
                nsCOMPtr<nsIDocShellTreeItem> selfAsItem = static_cast<nsIDocShellTreeItem *>(this);
                if (foundItem != root && foundItem != selfAsItem) {
                    // Are we an ancestor of the foundItem ?
                    bool isAncestor = false;

                    nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
                    foundItem->GetSameTypeParent(getter_AddRefs(parentAsItem));

                    while (parentAsItem) {
                        if (parentAsItem == selfAsItem) {
                        parentAsItem->GetParent(getter_AddRefs(tmp));

                        if (tmp && tmp == selfAsItem) {
                            isAncestor = true;
                            break;
                        }
                        parentAsItem->GetSameTypeParent(getter_AddRefs(parentAsItem));
                    }

                    if (!isAncestor) {
                        // No, we are not an ancestor and our document is
                        // sandboxed, we can't allow this.
                        foundItem = nullptr;
                    }
                } else {

                            break;
                        }
                        tmp->GetParent(getter_AddRefs(tmp));
                    }
                }
            }

            foundItem.swap(*_retval);
        }
        return NS_OK;
    }
}

nsresult
nsDocShell::DoFindItemWithName(const PRUnichar * aName,
                             nsISupports * aRequestor,
                             nsIDocShellTreeItem * aOriginalRequestor,
                             nsIDocShellTreeItem ** _retval)
{
    // First we check our name.
    if (mName.Equals(aName) && ItemIsActive(this)) {
        CanAccessItem(this, aOriginalRequestor)) {
        NS_ADDREF(*_retval = this);
        return NS_OK;
    }

    // This QI may fail, but the places where we want to compare, comparing
    // against nullptr serves the same purpose.
    nsCOMPtr<nsIDocShellTreeItem> reqAsTreeItem(do_QueryInterface(aRequestor));







private:
    nsCOMPtr<nsIAtom> mForcedCharset;
    nsCOMPtr<nsIAtom> mParentCharset;
    nsTObserverArray<nsWeakPtr> mPrivacyObservers;
    int32_t           mParentCharsetSource;
    nsCString         mOriginalUriString;

    // Separate function to do the actual name (i.e. not _top, _self etc.)
    // searching for FindItemWithName.
    nsresult DoFindItemWithName(const PRUnichar * aName,
                                 nsISupports * aRequestor,
                                 nsIDocShellTreeItem * aOriginalRequestor,
                                 nsIDocShellTreeItem ** _retval);

#ifdef DEBUG
    // We're counting the number of |nsDocShells| to help find leaks
    static unsigned long gNumberOfDocShells;
#endif /* DEBUG */

public:
    class InterfaceRequestorProxy : public nsIInterfaceRequestor {
    public:

Return to bug 838692