Bug 1038756: Callsites creating a channel in /docshell/ (r=bz)

docshell/base/nsDocShell.cpp

@@ -112,6 +112,7 @@
 #include "nsIWindowWatcher.h"
 #include "nsIPromptFactory.h"
 #include "nsITransportSecurityInfo.h"
+#include "nsINode.h"
 #include "nsINSSErrorsService.h"
 #include "nsIApplicationCacheChannel.h"
 #include "nsIApplicationCacheContainer.h"
@@ -9178,6 +9179,29 @@ nsDocShell::JustStartedNetworkLoad()
            mDocumentRequest != GetCurrentDocChannel();
 }
 
+nsresult
+nsDocShell::CreatePrincipalFromReferrer(nsIURI*        aReferrer,
+                                        nsIPrincipal** outPrincipal)
+{
+  nsresult rv;
+  nsCOMPtr<nsIScriptSecurityManager> secMan =
+    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uint32_t appId;
+  rv = GetAppId(&appId);
+  NS_ENSURE_SUCCESS(rv, rv);
+  bool isInBrowserElement;
+  rv = GetIsInBrowserElement(&isInBrowserElement);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = secMan->GetAppCodebasePrincipal(aReferrer,
+                                       appId,
+                                       isInBrowserElement,
+                                       outPrincipal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDocShell::InternalLoad(nsIURI * aURI,
                          nsIURI * aReferrer,
@@ -9296,12 +9320,8 @@ nsDocShell::InternalLoad(nsIURI * aURI,
     // XXXbz would be nice to know the loading principal here... but we don't
     nsCOMPtr<nsIPrincipal> loadingPrincipal = do_QueryInterface(aOwner);
     if (!loadingPrincipal && aReferrer) {
-        nsCOMPtr<nsIScriptSecurityManager> secMan =
+      rv = CreatePrincipalFromReferrer(aReferrer, getter_AddRefs(loadingPrincipal));
-            do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        rv = secMan->GetSimpleCodebasePrincipal(aReferrer,
-                                                getter_AddRefs(loadingPrincipal));
     }
 
     rv = NS_CheckContentLoadPolicy(contentType,
@@ -9967,7 +9987,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                    (aFlags & INTERNAL_LOAD_FLAGS_FIRST_LOAD) != 0,
                    (aFlags & INTERNAL_LOAD_FLAGS_BYPASS_CLASSIFIER) != 0,
                    (aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_COOKIES) != 0,
-                   srcdoc, aBaseURI);
+                   srcdoc, aBaseURI, contentType);
     if (req && aRequest)
         NS_ADDREF(*aRequest = req);
 
@@ -10047,7 +10067,8 @@ nsDocShell::DoURILoad(nsIURI * aURI,
                       bool aBypassClassifier,
                       bool aForceAllowCookies,
                       const nsAString &aSrcdoc,
-                      nsIURI * aBaseURI)
+                      nsIURI * aBaseURI,
+                      nsContentPolicyType aContentPolicyType)
 {
 #ifdef MOZ_VISUAL_EVENT_TRACER
     nsAutoCString urlSpec;
@@ -10118,14 +10139,36 @@ nsDocShell::DoURILoad(nsIURI * aURI,
     nsCOMPtr<nsIChannel> channel;
 
     bool isSrcdoc = !aSrcdoc.IsVoid();
+
+    nsCOMPtr<nsINode> requestingNode;
+    if (mScriptGlobal) {
+      requestingNode = mScriptGlobal->GetFrameElementInternal();
+      if (!requestingNode) {
+        requestingNode = mScriptGlobal->GetExtantDoc();
+      }
+    }
+    nsCOMPtr<nsIPrincipal> requestingPrincipal = do_QueryInterface(aOwner);
+    if (!requestingPrincipal && aReferrerURI) {
+      rv = CreatePrincipalFromReferrer(aReferrerURI,
+                                       getter_AddRefs(requestingPrincipal));
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+    else {
+      requestingPrincipal = nsContentUtils::GetSystemPrincipal();
+    }
+
     if (!isSrcdoc) {
-        rv = NS_NewChannel(getter_AddRefs(channel),
+        rv = NS_NewChannelInternal(getter_AddRefs(channel),
-                           aURI,
+                                   aURI,
-                           nullptr,
+                                   requestingNode,
-                           nullptr,
+                                   requestingPrincipal,
-                           static_cast<nsIInterfaceRequestor *>(this),
+                                   nsILoadInfo::SEC_NORMAL,
-                           loadFlags,
+                                   aContentPolicyType,
-                           channelPolicy);
+                                   channelPolicy,
+                                   nullptr,   // loadGroup
+                                   static_cast<nsIInterfaceRequestor*>(this),
+                                   loadFlags);
+
         if (NS_FAILED(rv)) {
             if (rv == NS_ERROR_UNKNOWN_PROTOCOL) {
                 // This is a uri with a protocol scheme we don't know how
@@ -10173,6 +10216,14 @@ nsDocShell::DoURILoad(nsIURI * aURI,
             MOZ_ASSERT(isc);
             isc->SetBaseURI(aBaseURI);
         }
+        // NS_NewInputStreamChannel does not yet attach the loadInfo in nsNetutil.h,
+        // hence we have to manually attach the loadInfo for that channel.
+        nsCOMPtr<nsILoadInfo> loadInfo =
+          new LoadInfo(requestingPrincipal,
+                       requestingNode,
+                       nsILoadInfo::SEC_NORMAL,
+                       aContentPolicyType);
+        channel->SetLoadInfo(loadInfo);
     }
 
     nsCOMPtr<nsIApplicationCacheChannel> appCacheChannel =

docshell/base/nsDocShell.h

@@ -9,6 +9,7 @@
 #define nsDocShell_h__
 
 #include "nsITimer.h"
+#include "nsContentPolicyUtils.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIBaseWindow.h"
@@ -317,7 +318,8 @@ protected:
                                bool aBypassClassifier,
                                bool aForceAllowCookies,
                                const nsAString &aSrcdoc,
-                               nsIURI * baseURI);
+                               nsIURI * baseURI,
+                               nsContentPolicyType aContentPolicyType);
     NS_IMETHOD AddHeadersToChannel(nsIInputStream * aHeadersData, 
                                   nsIChannel * aChannel);
     virtual nsresult DoChannelLoad(nsIChannel * aChannel,
@@ -698,6 +700,9 @@ protected:
 
     bool JustStartedNetworkLoad();
 
+    nsresult CreatePrincipalFromReferrer(nsIURI*        aReferrer,
+                                         nsIPrincipal** outPrincipal);
+
     enum FrameType {
         eFrameTypeRegular,
         eFrameTypeBrowser,