Attachment #786299 for bug #886262

Attachment #786299: Fix for Bug 886262: Ensure sandbox flags and, where necessary, null principal are set for child objects. for bug #886262

View | Details | Raw Unified | Return to bug 886262
Collapse All | Expand All





  // Just to be safe, recheck uri.
  rv = CheckURILoad(mURIToLoad);
  NS_ENSURE_SUCCESS(rv, rv);

  nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
  mDocShell->CreateLoadInfo(getter_AddRefs(loadInfo));
  NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);

  // Does this frame have a parent which is already sandboxed or is this
  // an <iframe> with a sandbox attribute?
  uint32_t sandboxFlags = 0;
  uint32_t parentSandboxFlags = mOwnerContent->OwnerDoc()->GetSandboxFlags();

  HTMLIFrameElement* iframe = HTMLIFrameElement::FromContent(mOwnerContent);

  if (iframe) {
    sandboxFlags = iframe->GetSandboxFlags();
  }

  if (sandboxFlags || parentSandboxFlags) {
    // The child can only add restrictions, never remove them.
    sandboxFlags |= parentSandboxFlags;
    mDocShell->SetSandboxFlags(sandboxFlags);
  }

  // If this frame is sandboxed with respect to origin we will set it up with
  // a null principal later in nsDocShell::DoURILoad.
  // We do it there to correctly sandbox content that was loaded into
  // the frame via other methods than the src attribute.
  // We'll use our principal, not that of the document loaded inside us.  This
  // is very important; needed to prevent XSS attacks on documents loaded in
  // subframes!
  loadInfo->SetOwner(mOwnerContent->NodePrincipal());

    doc->GetContainer();
  nsCOMPtr<nsIWebNavigation> parentAsWebNav = do_QueryInterface(container);
  NS_ENSURE_STATE(parentAsWebNav);

  // Create the docshell...
  mDocShell = do_CreateInstance("@mozilla.org/docshell;1");
  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);

  // Apply sandbox flags even if our owner is not an iframe, as this copies
  // flags from our owning content's owning document.
  uint32_t sandboxFlags = 0;
  HTMLIFrameElement* iframe = HTMLIFrameElement::FromContent(mOwnerContent);
  if (iframe) {
    sandboxFlags = iframe->GetSandboxFlags();
  }
  ApplySandboxFlags(sandboxFlags);

  if (!mNetworkCreated) {
    if (mDocShell) {
      mDocShell->SetCreatedDynamically(true);
    }
  }

  // Get the frame name and tell the docshell about it.
  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);


nsView*
nsFrameLoader::GetDetachedSubdocView(nsIDocument** aContainerDoc) const
{
  NS_IF_ADDREF(*aContainerDoc = mContainerDocWhileDetached);
  return mDetachedSubdocViews;
}

void
nsFrameLoader::ApplySandboxFlags(uint32_t sandboxFlags)
{
  if (mDocShell) {
    uint32_t parentSandboxFlags = mOwnerContent->OwnerDoc()->GetSandboxFlags();

    // The child can only add restrictions, never remove them.
    sandboxFlags |= parentSandboxFlags;
    mDocShell->SetSandboxFlags(sandboxFlags);
  }
}

/* virtual */ void
nsFrameLoader::AttributeChanged(nsIDocument* aDocument,
                                mozilla::dom::Element* aElement,
                                int32_t      aNameSpaceID,
                                nsIAtom*     aAttribute,
                                int32_t      aModType)
{
  MOZ_ASSERT(mObservingOwnerContent);





                             nsIDocument* aContainerDoc);

  /**
   * Retrieves the detached view and the document containing the view,
   * as set by SetDetachedSubdocView().
   */
  nsView* GetDetachedSubdocView(nsIDocument** aContainerDoc) const;

  /**
   * Applies a new set of sandbox flags. These are merged with the sandbox
   * flags from our owning content's owning document with a logical OR, this
   * ensures that we can only add restrictions and never remove them.
   */
  void ApplySandboxFlags(uint32_t sandboxFlags);

private:

  void SetOwnerContent(mozilla::dom::Element* aContent);

  bool ShouldUseRemoteProcess();

  /**
   * Is this a frameloader for a bona fide <iframe mozbrowser> or





#include "nsGkAtoms.h"
#include "nsThreadUtils.h"
#include "nsNetUtil.h"
#include "nsMimeTypes.h"
#include "nsStyleUtil.h"
#include "nsGUIEvent.h"
#include "nsUnicharUtils.h"
#include "mozilla/Preferences.h"
#include "nsSandboxFlags.h"

// Concrete classes
#include "nsFrameLoader.h"

#include "nsObjectLoadingContent.h"
#include "mozAutoDocUpdate.h"
#include "nsIContentSecurityPolicy.h"
#include "nsIChannelPolicy.h"

  NS_ENSURE_SUCCESS(rv, rv);

  // Referrer
  nsCOMPtr<nsIHttpChannel> httpChan(do_QueryInterface(chan));
  if (httpChan) {
    httpChan->SetReferrer(doc->GetDocumentURI());
  }

  // Set up the channel's principal and such, like nsDocShell::DoURILoad does.
  // If the content being loaded should be sandboxed with respect to origin we
  // create a new null principal here. nsContentUtils::SetUpChannelOwner is
  // used with a flag to force it to be set as the channel owner.
  nsCOMPtr<nsIPrincipal> ownerPrincipal;
  uint32_t sandboxFlags = doc->GetSandboxFlags();
  if (sandboxFlags & SANDBOXED_ORIGIN) {
    ownerPrincipal = do_CreateInstance("@mozilla.org/nullprincipal;1");
  } else {
    // Not sandboxed - we allow the content to assume its natural owner.
    ownerPrincipal = thisContent->NodePrincipal();
  }
  nsContentUtils::SetUpChannelOwner(ownerPrincipal, chan, mURI, true,
                                    sandboxFlags & SANDBOXED_ORIGIN);

  nsCOMPtr<nsIScriptChannel> scriptChannel = do_QueryInterface(chan);
  if (scriptChannel) {
    // Allow execution against our context if the principals match
    scriptChannel->SetExecutionPolicy(nsIScriptChannel::EXECUTE_NORMAL);
  }

  // AsyncOpen can fail if a file does not exist.





}

nsresult
HTMLIFrameElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                const nsAttrValue* aValue,
                                bool aNotify)
{
  if (aName == nsGkAtoms::sandbox && aNameSpaceID == kNameSpaceID_None) {
    // If we have an nsFrameLoader, parse the new value of the sandbox
    // attribute and apply the new sandbox flags.
    if (mFrameLoader) {
      // If a nullptr aValue is passed in, we want to clear the sandbox flags
      // which we will do by setting them to 0.
      uint32_t newFlags = 0;
      if (aValue) {
        nsAutoString strValue;
        aValue->ToString(strValue);
        newFlags = nsContentUtils::ParseSandboxAttributeToFlags(strValue);
      }   
      mFrameLoader->ApplySandboxFlags(newFlags);
          newFlags = nsContentUtils::ParseSandboxAttributeToFlags(
            strValue);
        }   
        docshell->SetSandboxFlags(newFlags);
      }
    }
  }
  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue,
                                            aNotify);
}

nsresult
HTMLIFrameElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,

Return to bug 886262