Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 11:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 700561 - Relax short-circuit principal checks on account of inner window reuse. r=bz

Browse Source
This commit is contained in:
Bobby Holley 2012-02-18 08:55:28 -08:00
parent 46a70d99b9
commit 6edd485a24
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
caps/src/nsScriptSecurityManager.cpp
View File

@ -2483,11 +2483,10 @@ nsScriptSecurityManager::doGetObjectPrincipal(JSObject *aObj
if (aAllowShortCircuit) {
nsIPrincipal *principal = doGetObjectPrincipal(origObj, false);
// Location is always wrapped (even for same-compartment), so we can
// loosen the check to same-origin instead of same-principal.
NS_ASSERTION(strcmp(jsClass->name, "Location") == 0 ?
NS_SUCCEEDED(CheckSameOriginPrincipal(result, principal)) :
result == principal,
// Because of inner window reuse, we can have objects with one principal
// living in a scope with a different (but same-origin) principal. So
// just check same-origin here.
NS_ASSERTION(NS_SUCCEEDED(CheckSameOriginPrincipal(result, principal)),
"Principal mismatch. Not good");
}
#endif

13
js/xpconnect/src/XPCWrappedNative.cpp
View File

@ -2917,9 +2917,18 @@ XPCWrappedNative::GetObjectPrincipal() const
{
nsIPrincipal* principal = GetScope()->GetPrincipal();
#ifdef DEBUG
// Because of inner window reuse, we can have objects with one principal
// living in a scope with a different (but same-origin) principal. So
// just check same-origin here.
nsCOMPtr<nsIScriptObjectPrincipal> objPrin(do_QueryInterface(mIdentity));
NS_ASSERTION(!objPrin || objPrin->GetPrincipal() == principal,
"Principal mismatch. Expect bad things to happen");
if (objPrin) {
bool equal;
if (!principal)
equal = !objPrin->GetPrincipal();
else
principal->Equals(objPrin->GetPrincipal(), &equal);
NS_ASSERTION(equal, "Principal mismatch. Expect bad things to happen");
}
#endif
return principal;
}