Bug 463327 - Enable stateful SJS handlers somehow other than through universal insta-XSS. r=honzab

netwerk/test/httpserver/httpd.js

@@ -525,6 +525,22 @@ nsHttpServer.prototype =
     return this._identity;
   },
 
+  //
+  // see nsIHttpServer.getState
+  //
+  getState: function(k)
+  {
+    return this._handler._getState(k);
+  },
+
+  //
+  // see nsIHttpServer.setState
+  //
+  setState: function(k, v)
+  {
+    return this._handler._setState(k, v);
+  },
+
   // NSISUPPORTS
 
   //
@@ -1938,6 +1954,11 @@ function ServerHandler(server)
    * when no index file is present.
    */
   this._indexHandler = defaultIndexHandler;
+
+  /**
+   * State storage for the server.
+   */
+  this._state = {};
 }
 ServerHandler.prototype =
 {
@@ -2351,6 +2372,12 @@ ServerHandler.prototype =
         var s = Cu.Sandbox(gGlobalObject);
         s.importFunction(dump, "dump");
 
+        // Define a basic key-value state-preservation API across requests, with
+        // keys initially corresponding to the empty string.
+        var self = this;
+        s.importFunction(function getState(k) { return self._getState(k); });
+        s.importFunction(function setState(k, v) { self._setState(k, v); });
+
         try
         {
           // Alas, the line number in errors dumped to console when calling the
@@ -2424,6 +2451,39 @@ ServerHandler.prototype =
     }
   },
 
+  /**
+   * Get the value corresponding to a given key for SJS state preservation
+   * across requests.
+   *
+   * @param k : string
+   *   the key whose corresponding value is to be returned
+   * @returns string
+   *   the corresponding value, which is initially the empty string
+   */
+  _getState: function(k)
+  {
+    NS_ASSERT(typeof k == "string");
+    var state = this._state;
+    if (k in state)
+      return state[k];
+    return state[k] = "";
+  },
+
+  /**
+   * Set the value corresponding to a given key for SJS state preservation
+   * across requests.
+   *
+   * @param k : string
+   *   the key whose corresponding value is to be set
+   * @param v : string
+   *   the value to be set
+   */
+  _setState: function(k, v)
+  {
+    NS_ASSERT(typeof v == "string");
+    this._state[k] = String(v);
+  },
+
   /**
    * Gets a content-type for the given file, first by checking for any custom
    * MIME-types registered with this handler for the file's extension, second by

netwerk/test/httpserver/nsIHttpServer.idl

@@ -52,7 +52,7 @@ interface nsIHttpServerIdentity;
 /**
  * An interface which represents an HTTP server.
  */
-[scriptable, uuid(9049C469-8402-4FA6-883C-826B0FE9CAF9)]
+[scriptable, uuid(ED95D475-3DFB-4995-AF27-8091337C8463)]
 interface nsIHttpServer : nsISupports
 {
   /**
@@ -187,6 +187,17 @@ interface nsIHttpServer : nsISupports
 
   /** Represents the locations at which this server is reachable. */
   readonly attribute nsIHttpServerIdentity identity;
+
+  /**
+   * Retrieves the string associated with the given key in this.  All keys are
+   * initially associated with the empty string.
+   */
+  AString getState(in AString key);
+
+  /**
+   * Sets the string associated with the given key in this.
+   */
+  void setState(in AString key, in AString value);
 };
 
 /**

netwerk/test/httpserver/test/data/sjs/state.sjs

@@ -0,0 +1,29 @@
+function handleRequest(request, response)
+{
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  var oldval = getState("foopy");
+  response.setHeader("X-Old-Value", oldval, false);
+
+  var newval = "ERROR NOT SET";
+  switch (request.queryString)
+  {
+    case "1":
+      newval = "first set!";
+      break;
+
+    case "2":
+      newval = "changed!";
+      break;
+
+    case "3":
+      newval = "done!";
+      break;
+
+    default:
+      throw "Ruh-roh!  " + request.queryString;
+  }
+
+  setState("foopy", newval);
+  response.setHeader("X-New-Value", newval, false);
+}

netwerk/test/httpserver/test/test_sjs_state.js

@@ -0,0 +1,133 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is httpd.js code.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jeff Walden <jwalden+code@mit.edu>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// exercises the server's state-preservation API
+
+const PORT = 4444;
+
+var srv;
+
+function run_test()
+{
+  srv = createServer();
+  var sjsDir = do_get_file("netwerk/test/httpserver/test/data/sjs/");
+  srv.registerDirectory("/", sjsDir);
+  srv.registerContentType("sjs", "sjs");
+  srv.registerPathHandler("/path-handler", pathHandler);
+  srv.start(PORT);
+
+  function done()
+  {
+    do_check_eq(srv.getState("foopy"), "done!");
+    srv.stop();
+  }
+
+  runHttpTests(tests, done);
+}
+
+
+/************
+ * HANDLERS *
+ ************/
+
+function pathHandler(request, response)
+{
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  var oldval = srv.getState("foopy");
+  response.setHeader("X-Old-Value", oldval, false);
+  var newval = "back to SJS!";
+  srv.setState("foopy", newval);
+  response.setHeader("X-New-Value", newval, false);
+}
+
+
+/***************
+ * BEGIN TESTS *
+ ***************/
+
+var test;
+var tests = [];
+
+
+function expectValues(ch, oldval, newval)
+{
+  do_check_eq(ch.getResponseHeader("X-Old-Value"), oldval);
+  do_check_eq(ch.getResponseHeader("X-New-Value"), newval);
+}
+
+
+test = new Test("http://localhost:4444/state.sjs?1",
+                null, start_initial);
+tests.push(test);
+
+function start_initial(ch, cx)
+{
+  expectValues(ch, "", "first set!");
+}
+
+
+test = new Test("http://localhost:4444/state.sjs?2",
+                null, start_next);
+tests.push(test);
+
+function start_next(ch, cx)
+{
+  expectValues(ch, "first set!", "changed!");
+}
+
+
+test = new Test("http://localhost:4444/path-handler",
+                null, start_handler);
+tests.push(test);
+
+function start_handler(ch, cx)
+{
+  expectValues(ch, "changed!", "back to SJS!");
+}
+
+
+test = new Test("http://localhost:4444/state.sjs?3",
+                null, start_last);
+tests.push(test);
+
+function start_last(ch, cx)
+{
+  expectValues(ch, "back to SJS!", "done!");
+}