Attachment 783470 Details for Bug 886262

[patch] Propagate the sandbox flags through in nsObjectLoadingContent.

object-sandbox (text/plain), 4.44 KB, created by Boris Zbarsky [:bzbarsky]

(hide)

Description:

Filename:

MIME Type:

Creator: Boris Zbarsky [:bzbarsky]

Size: 4.44 KB

patch

obsolete

># HG changeset patch
># User Boris Zbarsky <bzbarsky@mit.edu>
># Date 1375233660 25200
># Node ID 18c9e4cf146afb2bc2ec933cd2cbb321f81ff1a1
># Parent  d879c9cff1940d5fb64ba044ee261414f0349a20
>Bug 886262.  Propagate the sandbox flags through in nsObjectLoadingContent.  r=smaug
>
>diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
>--- a/content/base/src/nsObjectLoadingContent.cpp
>+++ b/content/base/src/nsObjectLoadingContent.cpp
>@@ -2108,16 +2108,19 @@ nsObjectLoadingContent::LoadObject(bool 
>       nsCOMPtr<nsIDocShell> docShell;
>       rv = mFrameLoader->GetDocShell(getter_AddRefs(docShell));
>       if (NS_FAILED(rv)) {
>         NS_NOTREACHED("Could not get DocShell from mFrameLoader?");
>         mType = eType_Null;
>         break;
>       }
> 
>+      // Make sure this docshell has our sandbox flags
>+      docShell->SetSandboxFlags(doc->GetSandboxFlags());
>+
>       nsCOMPtr<nsIInterfaceRequestor> req(do_QueryInterface(docShell));
>       NS_ASSERTION(req, "Docshell must be an ifreq");
> 
>       nsCOMPtr<nsIURILoader>
>         uriLoader(do_GetService(NS_URI_LOADER_CONTRACTID, &rv));
>       if (NS_FAILED(rv)) {
>         NS_NOTREACHED("Failed to get uriLoader service");
>         mType = eType_Null;
>diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
>--- a/content/base/test/Makefile.in
>+++ b/content/base/test/Makefile.in
>@@ -237,16 +237,17 @@ MOCHITEST_FILES_A = \
> 		bug282547.sjs \
> 		test_domparser_null_char.html \
> 		test_bug811701.html \
> 		test_bug811701.xhtml \
> 		test_bug820909.html \
> 		test_bug704063.html \
> 		test_bug894874.html \
> 		test_bug895974.html \
>+		test_bug886262.html \
> 		$(NULL)
> 
> MOCHITEST_FILES_B = \
> 		test_bug459424.html \
> 		bug461735-redirect1.sjs \
> 		bug461735-redirect2.sjs \
> 		bug461735-post-redirect.js \
> 		test_bug513194.html \
>diff --git a/content/base/test/test_bug886262.html b/content/base/test/test_bug886262.html
>new file mode 100644
>--- /dev/null
>+++ b/content/base/test/test_bug886262.html
>@@ -0,0 +1,62 @@
>+<!DOCTYPE HTML>
>+<html>
>+
>+<head>
>+  <meta charset="utf-8">
>+  <title>Test for Bug 886262</title>
>+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
>+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
>+  <script type="application/javascript">
>+
>+  /** Test for Bug 886262 **/
>+  SimpleTest.waitForExplicitFinish();
>+  var gotSet1 = false;
>+  var gotSet2 = false;
>+  var gotSet3 = false;
>+
>+  var gotMessage = false, gotLoad = false;
>+
>+  window.onmessage = function(e) {
>+    ok(e.data.ran, "Sandboxed allow-scripts iframe should run script");
>+    ok(e.data.gotSet,
>+       "Sandboxed allow-scripts iframe's kid should not be able to set props on its parent");
>+    ok(!gotSet2,
>+       "Sandboxed allow-scripts iframe should not be able to set props on us");
>+    if (gotLoad) {
>+      SimpleTest.finish();
>+    } else {
>+      gotMessage = true;
>+    }
>+  }
>+  addLoadEvent(function() {
>+    ok(!gotSet1, "Sandboxed iframe should not be able to set props on us");
>+    ok(!frames[0][0].scriptRan, "Sandboxed iframe should not run script");
>+
>+    ok(gotSet3,
>+       "Sandboxed allow-scripts same-origin iframe should be able to set " +
>+       "props on us");
>+    ok(frames[2][0].scriptRan,
>+       "Sandboxed allow-scripts same-origin iframe should run script");
>+    if (gotMessage) {
>+      SimpleTest.finish();
>+    } else {
>+      gotLoad = true;
>+    }
>+  });
>+  </script>
>+</head>
>+<body>
>+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=886262">Mozilla Bug 886262</a>
>+<p id="display"></p>
>+<div id="content" style="display: none">
>+  <iframe sandbox="allow-same-origin" src="data:text/html,<object%20data='data:text/html,<script>var scriptRan = true;</script><script>parent.parent.gotSet1 = true</script>'></object>"></iframe>
>+  <iframe sandbox="allow-scripts"
>+  src="data:text/html,<script>var gotSet = false;</script><object%20data='data:text/html,<script>var scriptRan = true;</script><script>parent.gotSet = true</script>'></object><script>window.onload = function() {parent.postMessage({ 'ran': frames[0].scriptRan, 'gotSet': window.gotSet }, '*'); }</script>"></iframe>
>+  <iframe sandbox="allow-scripts allow-same-origin" src="data:text/html,<object%20data='data:text/html,<script>var scriptRan = true;</script><script>parent.parent.gotSet3 = true</script>'></object>"></iframe>
>+</div>
>+<pre id="test">
>+</pre>
>+</body>
>+</html>

Actions: View | Diff | Review

Attachments on bug 886262: 783470 | 783677 | 783678 | 785657 | 785658 | 785922 | 786299 | 786305