2010-06-03 22:27:29 +00:00
|
|
|
/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
|
|
|
|
* vim: set ts=4 sw=4 et tw=99:
|
|
|
|
*
|
2012-05-21 11:12:37 +00:00
|
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
2010-06-03 22:27:29 +00:00
|
|
|
|
|
|
|
#ifndef jswrapper_h___
|
|
|
|
#define jswrapper_h___
|
|
|
|
|
2011-11-20 20:22:51 +00:00
|
|
|
#include "mozilla/Attributes.h"
|
2011-11-14 18:31:46 +00:00
|
|
|
|
2010-06-03 22:27:29 +00:00
|
|
|
#include "jsapi.h"
|
|
|
|
#include "jsproxy.h"
|
|
|
|
|
2011-09-09 03:29:15 +00:00
|
|
|
namespace js {
|
2010-09-26 03:05:36 +00:00
|
|
|
|
2012-01-02 18:05:19 +00:00
|
|
|
class DummyFrameGuard;
|
|
|
|
|
2012-04-19 18:19:41 +00:00
|
|
|
/* Base class that just implements no-op forwarding methods for fundamental
|
2012-04-15 23:43:14 +00:00
|
|
|
* traps. This is meant to be used as a base class for ProxyHandlers that
|
|
|
|
* want transparent forwarding behavior but don't want to use the derived
|
|
|
|
* traps and other baggage of js::Wrapper.
|
|
|
|
*/
|
2012-05-17 11:19:37 +00:00
|
|
|
class JS_FRIEND_API(AbstractWrapper) : public IndirectProxyHandler
|
2011-09-09 03:29:15 +00:00
|
|
|
{
|
2012-04-19 18:19:41 +00:00
|
|
|
unsigned mFlags;
|
2010-07-02 01:06:33 +00:00
|
|
|
public:
|
2012-04-19 18:19:41 +00:00
|
|
|
unsigned flags() const { return mFlags; }
|
|
|
|
|
|
|
|
explicit AbstractWrapper(unsigned flags);
|
2010-06-03 22:27:29 +00:00
|
|
|
|
2010-07-02 20:54:53 +00:00
|
|
|
/* ES5 Harmony fundamental wrapper traps. */
|
2010-10-10 22:36:04 +00:00
|
|
|
virtual bool getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
2010-10-10 22:36:04 +00:00
|
|
|
virtual bool getOwnPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
2010-10-10 22:36:04 +00:00
|
|
|
virtual bool defineProperty(JSContext *cx, JSObject *wrapper, jsid id,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
|
|
|
virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
|
|
|
virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
2010-07-02 20:54:53 +00:00
|
|
|
|
2012-03-23 21:59:27 +00:00
|
|
|
/* Policy enforcement traps.
|
|
|
|
*
|
|
|
|
* enter() allows the policy to specify whether the caller may perform |act|
|
|
|
|
* on the underlying object's |id| property. In the case when |act| is CALL,
|
|
|
|
* |id| is generally JSID_VOID.
|
|
|
|
*
|
|
|
|
* leave() allows the policy to undo various scoped state changes taken in
|
|
|
|
* enter(). If enter() succeeds, leave() must be called upon completion of
|
|
|
|
* the approved action.
|
|
|
|
*
|
|
|
|
* The |act| parameter to enter() specifies the action being performed. GET,
|
|
|
|
* SET, and CALL are self-explanatory, but PUNCTURE requires more explanation:
|
|
|
|
*
|
|
|
|
* GET and SET allow for a very fine-grained security membrane, through
|
|
|
|
* which access can be granted or denied on a per-property, per-object, and
|
|
|
|
* per-action basis. Sometimes though, we just want to asks if we can access
|
|
|
|
* _everything_ behind the wrapper barrier. For example, when the structured
|
|
|
|
* clone algorithm runs up against a cross-compartment wrapper, it needs to
|
|
|
|
* know whether it can enter the compartment and keep cloning, or whether it
|
|
|
|
* should throw. This is the role of PUNCTURE.
|
|
|
|
*
|
|
|
|
* PUNCTURE allows the policy to specify whether the wrapper barrier may
|
|
|
|
* be lifted - that is to say, whether the caller is allowed to access
|
|
|
|
* anything that the wrapped object could access. This is a very powerful
|
|
|
|
* permission, and thus should generally be denied for security wrappers
|
|
|
|
* except under very special circumstances. When |act| is PUNCTURE, |id|
|
|
|
|
* should be JSID_VOID.
|
|
|
|
* */
|
|
|
|
enum Action { GET, SET, CALL, PUNCTURE };
|
2011-01-30 02:48:30 +00:00
|
|
|
virtual bool enter(JSContext *cx, JSObject *wrapper, jsid id, Action act, bool *bp);
|
2010-10-10 22:36:04 +00:00
|
|
|
virtual void leave(JSContext *cx, JSObject *wrapper);
|
2010-06-03 22:27:29 +00:00
|
|
|
|
2012-04-15 23:43:14 +00:00
|
|
|
static JSObject *wrappedObject(const JSObject *wrapper);
|
2012-04-19 18:19:41 +00:00
|
|
|
static AbstractWrapper *wrapperHandler(const JSObject *wrapper);
|
2012-04-15 23:43:14 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
/* No-op wrapper handler base class. */
|
2012-06-01 10:51:20 +00:00
|
|
|
class JS_FRIEND_API(DirectWrapper) : public AbstractWrapper
|
2012-04-15 23:43:14 +00:00
|
|
|
{
|
|
|
|
public:
|
2012-06-01 10:51:20 +00:00
|
|
|
explicit DirectWrapper(unsigned flags);
|
2012-04-15 23:43:14 +00:00
|
|
|
|
|
|
|
typedef enum { PermitObjectAccess, PermitPropertyAccess, DenyAccess } Permission;
|
|
|
|
|
2012-06-01 10:51:20 +00:00
|
|
|
virtual ~DirectWrapper();
|
2012-04-15 23:43:14 +00:00
|
|
|
|
|
|
|
/* ES5 Harmony derived wrapper traps. */
|
|
|
|
virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp) MOZ_OVERRIDE;
|
|
|
|
virtual bool set(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, bool strict,
|
|
|
|
Value *vp) MOZ_OVERRIDE;
|
|
|
|
virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
|
|
|
virtual bool iterate(JSContext *cx, JSObject *wrapper, unsigned flags, Value *vp) MOZ_OVERRIDE;
|
|
|
|
|
|
|
|
/* Spidermonkey extensions. */
|
|
|
|
virtual bool call(JSContext *cx, JSObject *wrapper, unsigned argc, Value *vp) MOZ_OVERRIDE;
|
|
|
|
virtual bool construct(JSContext *cx, JSObject *wrapper, unsigned argc, Value *argv, Value *rval) MOZ_OVERRIDE;
|
|
|
|
virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
|
|
|
|
virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper) MOZ_OVERRIDE;
|
|
|
|
virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, unsigned indent) MOZ_OVERRIDE;
|
|
|
|
|
|
|
|
using AbstractWrapper::Action;
|
|
|
|
|
2012-06-01 10:51:20 +00:00
|
|
|
static DirectWrapper singleton;
|
2010-06-03 22:27:29 +00:00
|
|
|
|
2010-10-10 22:36:04 +00:00
|
|
|
static JSObject *New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
|
2012-06-01 10:51:20 +00:00
|
|
|
DirectWrapper *handler);
|
2010-06-23 21:35:10 +00:00
|
|
|
|
2012-04-15 23:43:14 +00:00
|
|
|
using AbstractWrapper::wrappedObject;
|
|
|
|
using AbstractWrapper::wrapperHandler;
|
2010-11-16 01:21:25 +00:00
|
|
|
|
|
|
|
enum {
|
|
|
|
CROSS_COMPARTMENT = 1 << 0,
|
|
|
|
LAST_USED_FLAG = CROSS_COMPARTMENT
|
|
|
|
};
|
2010-09-20 21:48:01 +00:00
|
|
|
|
2010-10-10 22:36:04 +00:00
|
|
|
static void *getWrapperFamily();
|
2010-06-23 21:35:10 +00:00
|
|
|
};
|
|
|
|
|
2012-06-01 10:51:20 +00:00
|
|
|
/*
|
|
|
|
* This typedef is only here to avoid code churn in xpconnect. It will be
|
|
|
|
* removed as soon as the Wrapper base class lands.
|
|
|
|
*/
|
|
|
|
typedef DirectWrapper Wrapper;
|
|
|
|
|
2010-06-24 21:45:32 +00:00
|
|
|
/* Base class for all cross compartment wrapper handlers. */
|
2012-06-01 10:51:20 +00:00
|
|
|
class JS_FRIEND_API(CrossCompartmentWrapper) : public DirectWrapper
|
2011-09-09 03:29:15 +00:00
|
|
|
{
|
2010-06-24 21:45:32 +00:00
|
|
|
public:
|
2012-02-28 23:11:11 +00:00
|
|
|
CrossCompartmentWrapper(unsigned flags);
|
2010-06-25 22:58:09 +00:00
|
|
|
|
2011-09-09 03:29:15 +00:00
|
|
|
virtual ~CrossCompartmentWrapper();
|
2010-06-24 21:45:32 +00:00
|
|
|
|
2010-07-02 20:54:53 +00:00
|
|
|
/* ES5 Harmony fundamental wrapper traps. */
|
2010-09-17 21:54:41 +00:00
|
|
|
virtual bool getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
2010-09-17 21:54:41 +00:00
|
|
|
virtual bool getOwnPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
2010-08-10 16:31:06 +00:00
|
|
|
virtual bool defineProperty(JSContext *cx, JSObject *wrapper, jsid id,
|
2011-11-14 18:31:46 +00:00
|
|
|
PropertyDescriptor *desc) MOZ_OVERRIDE;
|
|
|
|
virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
|
|
|
virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
2010-07-02 20:54:53 +00:00
|
|
|
|
|
|
|
/* ES5 Harmony derived wrapper traps. */
|
2011-11-14 18:31:46 +00:00
|
|
|
virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp) MOZ_OVERRIDE;
|
2011-02-09 19:31:40 +00:00
|
|
|
virtual bool set(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, bool strict,
|
2011-11-14 18:31:46 +00:00
|
|
|
Value *vp) MOZ_OVERRIDE;
|
|
|
|
virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
|
2012-02-28 23:11:11 +00:00
|
|
|
virtual bool iterate(JSContext *cx, JSObject *wrapper, unsigned flags, Value *vp) MOZ_OVERRIDE;
|
2010-06-24 21:45:32 +00:00
|
|
|
|
|
|
|
/* Spidermonkey extensions. */
|
2012-02-28 23:11:11 +00:00
|
|
|
virtual bool call(JSContext *cx, JSObject *wrapper, unsigned argc, Value *vp) MOZ_OVERRIDE;
|
|
|
|
virtual bool construct(JSContext *cx, JSObject *wrapper, unsigned argc, Value *argv, Value *rval) MOZ_OVERRIDE;
|
2011-11-14 18:31:46 +00:00
|
|
|
virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
|
|
|
|
virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp) MOZ_OVERRIDE;
|
|
|
|
virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper) MOZ_OVERRIDE;
|
2012-02-28 23:11:11 +00:00
|
|
|
virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, unsigned indent) MOZ_OVERRIDE;
|
2011-11-14 18:31:46 +00:00
|
|
|
virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp) MOZ_OVERRIDE;
|
2012-02-07 18:57:16 +00:00
|
|
|
virtual bool iteratorNext(JSContext *cx, JSObject *wrapper, Value *vp);
|
2011-07-08 00:31:24 +00:00
|
|
|
|
2011-09-09 03:29:15 +00:00
|
|
|
static CrossCompartmentWrapper singleton;
|
2010-06-24 21:45:32 +00:00
|
|
|
};
|
|
|
|
|
2011-10-04 17:50:25 +00:00
|
|
|
/*
|
|
|
|
* Base class for security wrappers. A security wrapper is potentially hiding
|
|
|
|
* all or part of some wrapped object thus SecurityWrapper defaults to denying
|
|
|
|
* access to the wrappee. This is the opposite of Wrapper which tries to be
|
|
|
|
* completely transparent.
|
|
|
|
*
|
|
|
|
* NB: Currently, only a few ProxyHandler operations are overridden to deny
|
|
|
|
* access, relying on derived SecurityWrapper to block access when necessary.
|
|
|
|
*/
|
|
|
|
template <class Base>
|
|
|
|
class JS_FRIEND_API(SecurityWrapper) : public Base
|
|
|
|
{
|
|
|
|
public:
|
2012-02-28 23:11:11 +00:00
|
|
|
SecurityWrapper(unsigned flags);
|
2011-10-04 17:50:25 +00:00
|
|
|
|
2011-11-14 18:31:46 +00:00
|
|
|
virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
|
|
|
|
virtual bool objectClassIs(JSObject *obj, ESClassValue classValue, JSContext *cx) MOZ_OVERRIDE;
|
2012-02-23 21:51:19 +00:00
|
|
|
virtual bool regexp_toShared(JSContext *cx, JSObject *proxy, RegExpGuard *g) MOZ_OVERRIDE;
|
2011-10-04 17:50:25 +00:00
|
|
|
};
|
|
|
|
|
2012-06-01 10:51:20 +00:00
|
|
|
typedef SecurityWrapper<DirectWrapper> SameCompartmentSecurityWrapper;
|
2011-10-04 17:50:25 +00:00
|
|
|
typedef SecurityWrapper<CrossCompartmentWrapper> CrossCompartmentSecurityWrapper;
|
|
|
|
|
2011-09-09 03:29:15 +00:00
|
|
|
/*
|
|
|
|
* A hacky class that lets a friend force a fake frame. We must already be
|
|
|
|
* in the compartment of |target| when we enter the forced frame.
|
|
|
|
*/
|
2011-05-02 22:47:10 +00:00
|
|
|
class JS_FRIEND_API(ForceFrame)
|
|
|
|
{
|
|
|
|
public:
|
|
|
|
JSContext * const context;
|
|
|
|
JSObject * const target;
|
|
|
|
private:
|
2011-06-07 23:43:18 +00:00
|
|
|
DummyFrameGuard *frame;
|
2011-05-02 22:47:10 +00:00
|
|
|
|
|
|
|
public:
|
|
|
|
ForceFrame(JSContext *cx, JSObject *target);
|
2011-05-24 15:45:36 +00:00
|
|
|
~ForceFrame();
|
2011-05-02 22:47:10 +00:00
|
|
|
bool enter();
|
|
|
|
};
|
|
|
|
|
2010-06-24 21:45:32 +00:00
|
|
|
extern JSObject *
|
2010-09-17 21:54:40 +00:00
|
|
|
TransparentObjectWrapper(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSObject *parent,
|
2012-02-28 23:11:11 +00:00
|
|
|
unsigned flags);
|
2010-06-24 21:45:32 +00:00
|
|
|
|
2012-02-21 18:31:35 +00:00
|
|
|
// Proxy family for wrappers. Public so that IsWrapper() can be fully inlined by
|
|
|
|
// jsfriendapi users.
|
|
|
|
extern JS_FRIEND_DATA(int) sWrapperFamily;
|
|
|
|
|
|
|
|
inline bool
|
|
|
|
IsWrapper(const JSObject *obj)
|
|
|
|
{
|
|
|
|
return IsProxy(obj) && GetProxyHandler(obj)->family() == &sWrapperFamily;
|
|
|
|
}
|
2012-01-26 13:55:27 +00:00
|
|
|
|
|
|
|
// Given a JSObject, returns that object stripped of wrappers. If
|
|
|
|
// stopAtOuter is true, then this returns the outer window if it was
|
|
|
|
// previously wrapped. Otherwise, this returns the first object for
|
|
|
|
// which JSObject::isWrapper returns false.
|
2012-05-22 21:54:08 +00:00
|
|
|
JS_FRIEND_API(JSObject *)
|
|
|
|
UnwrapObject(JSObject *obj, bool stopAtOuter = true, unsigned *flagsp = NULL);
|
2012-01-26 13:55:27 +00:00
|
|
|
|
2012-03-23 21:59:27 +00:00
|
|
|
// Given a JSObject, returns that object stripped of wrappers. At each stage,
|
|
|
|
// the security wrapper has the opportunity to veto the unwrap. Since checked
|
|
|
|
// code should never be unwrapping outer window wrappers, we always stop at
|
|
|
|
// outer windows.
|
2012-05-22 21:54:08 +00:00
|
|
|
JS_FRIEND_API(JSObject *)
|
|
|
|
UnwrapObjectChecked(JSContext *cx, JSObject *obj);
|
2012-03-23 21:59:27 +00:00
|
|
|
|
2012-06-04 08:13:18 +00:00
|
|
|
JS_FRIEND_API(bool)
|
2012-05-22 21:54:08 +00:00
|
|
|
IsCrossCompartmentWrapper(const JSObject *obj);
|
|
|
|
|
|
|
|
void
|
|
|
|
NukeCrossCompartmentWrapper(JSObject *wrapper);
|
2011-10-04 14:06:54 +00:00
|
|
|
|
|
|
|
} /* namespace js */
|
2010-06-03 22:27:29 +00:00
|
|
|
|
|
|
|
#endif
|