Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 20:05:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1415352: Part 4c - Use subject principal as the triggering principal for inline <style> nodes. r=bz

Browse Source 
This change captures the subject principal when a scripted caller sets the
textContent or innerHTML property of a <style> node, and uses it as the
triggering principal for the resulting stylesheet.

If the node contents are modified in any way other than through textContent or
innerHTML, the triggering principal is forgotten (which is an intentional
design feature).

MozReview-Commit-ID: GacZFIB5BzS

--HG--
extra : rebase_source : 04926f30b8e2831d18d3fb64b850f670f006eb85
This commit is contained in:
Kris Maglione 2017-11-07 14:25:45 -08:00
parent 77ae77c2c9
commit 1653b08073
5 changed files with 37 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dom/base/nsStyleLinkElement.cpp
View File

@ -540,16 +540,16 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument* aOldDocument,
"<link> is not 'inline', and needs different CSP checks");
if (!nsStyleUtil::CSPAllowsInlineStyle(thisContent,
thisContent->NodePrincipal(),
nullptr,
triggeringPrincipal,
doc->GetDocumentURI(),
mLineNumber, text, &rv))
return rv;
// Parse the style sheet.
rv = doc->CSSLoader()->
LoadInlineStyle(thisContent, text, mLineNumber, title, media,
referrerPolicy, scopeElement, aObserver, &doneLoading,
&isAlternate);
LoadInlineStyle(thisContent, text, triggeringPrincipal, mLineNumber,
title, media, referrerPolicy, scopeElement,
aObserver, &doneLoading, &isAlternate);
}
else {
nsAutoString integrity;

15
dom/html/HTMLStyleElement.cpp
View File

@ -100,6 +100,7 @@ HTMLStyleElement::ContentRemoved(nsIDocument* aDocument,
void
HTMLStyleElement::ContentChanged(nsIContent* aContent)
{
mTriggeringPrincipal = nullptr;
if (nsContentUtils::IsInSameAnonymousTree(this, aContent)) {
UpdateStyleSheetInternal(nullptr, nullptr);
}
@ -176,13 +177,23 @@ void
HTMLStyleElement::SetInnerHTML(const nsAString& aInnerHTML,
nsIPrincipal& aScriptedPrincipal,
ErrorResult& aError)
{
SetTextContentInternal(aInnerHTML, &aScriptedPrincipal, aError);
}
void
HTMLStyleElement::SetTextContentInternal(const nsAString& aTextContent,
nsIPrincipal* aScriptedPrincipal,
ErrorResult& aError)
{
SetEnableUpdates(false);
aError = nsContentUtils::SetNodeTextContent(this, aInnerHTML, true);
aError = nsContentUtils::SetNodeTextContent(this, aTextContent, true);
SetEnableUpdates(true);
mTriggeringPrincipal = aScriptedPrincipal;
UpdateStyleSheetInternal(nullptr, nullptr);
}
@ -190,7 +201,7 @@ already_AddRefed<nsIURI>
HTMLStyleElement::GetStyleSheetURL(bool* aIsInline, nsIPrincipal** aTriggeringPrincipal)
{
*aIsInline = true;
*aTriggeringPrincipal = nullptr;
*aTriggeringPrincipal = do_AddRef(mTriggeringPrincipal).take();
return nullptr;
}

3
dom/html/HTMLStyleElement.h
View File

@ -36,6 +36,9 @@ public:
virtual void SetInnerHTML(const nsAString& aInnerHTML,
nsIPrincipal& aSubjectPrincipal,
mozilla::ErrorResult& aError) override;
virtual void SetTextContentInternal(const nsAString& aTextContent,
nsIPrincipal* aSubjectPrincipal,
mozilla::ErrorResult& aError) override;
virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
nsIContent* aBindingParent,

15
layout/style/Loader.cpp
View File

@ -1848,6 +1848,7 @@ Loader::DoSheetComplete(SheetLoadData* aLoadData, nsresult aStatus,
nsresult
Loader::LoadInlineStyle(nsIContent* aElement,
const nsAString& aBuffer,
nsIPrincipal* aTriggeringPrincipal,
uint32_t aLineNumber,
const nsAString& aTitle,
const nsAString& aMedia,
@ -1900,12 +1901,22 @@ Loader::LoadInlineStyle(nsIContent* aElement,
NS_ENSURE_SUCCESS(rv, rv);
}
nsIPrincipal* principal = aElement->NodePrincipal();
if (aTriggeringPrincipal) {
// The triggering principal may be an expanded principal, which is safe to
// use for URL security checks, but not as the loader principal for a
// stylesheet. So treat this as principal inheritance, and downgrade if
// necessary.
principal = BasePrincipal::Cast(aTriggeringPrincipal)->PrincipalToInherit();
}
SheetLoadData* data = new SheetLoadData(this, aTitle, nullptr, sheet,
owningElement, *aIsAlternate,
aObserver, nullptr, static_cast<nsINode*>(aElement));
aObserver, nullptr,
static_cast<nsINode*>(aElement));
// We never actually load this, so just set its principal directly
sheet->SetPrincipal(aElement->NodePrincipal());
sheet->SetPrincipal(principal);
NS_ADDREF(data);
data->mLineNumber = aLineNumber;

4
layout/style/Loader.h
View File

@ -227,6 +227,9 @@ public:
* @param aElement the element linking to the stylesheet. This must not be
* null and must implement nsIStyleSheetLinkingElement.
* @param aBuffer the stylesheet data
* @param aTriggeringPrincipal The principal of the scripted caller that
* initiated the load, if available. Otherwise
* null.
* @param aLineNumber the line number at which the stylesheet data started.
* @param aTitle the title of the sheet.
* @param aMedia the media string for the sheet.
@ -239,6 +242,7 @@ public:
*/
nsresult LoadInlineStyle(nsIContent* aElement,
const nsAString& aBuffer,
nsIPrincipal* aTriggeringPrincipal,
uint32_t aLineNumber,
const nsAString& aTitle,
const nsAString& aMedia,