Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-28 04:35:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 813901 - Validate __exposedProps__. r=mrbkap

Browse Source 
This also involves modifying test_cows to deep clone in getCOW.
This commit is contained in:
Bobby Holley 2012-12-07 14:49:11 -08:00
parent 2582344755
commit 8d249e9c73
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/xpconnect/tests/chrome/test_cows.xul
View File

@ -27,6 +27,8 @@ var test_utils = window.QueryInterface(Ci.nsIInterfaceRequestor).
getInterface(Ci.nsIDOMWindowUtils);
function getCOW(x) {
if (typeof x != 'object' && typeof x != 'function')
return x;
var rval = {};
if (typeof x == "function")
rval = eval(uneval(x));
@ -34,7 +36,7 @@ function getCOW(x) {
if (x.__lookupGetter__(i))
rval.__defineGetter__(i, eval(uneval(x.__lookupGetter__(i))))
else
rval[i] = x[i];
rval[i] = getCOW(x[i]);
}
return rval;
}

11
js/xpconnect/wrappers/AccessCheck.cpp
View File

@ -52,6 +52,12 @@ AccessCheck::subsumes(JSCompartment *a, JSCompartment *b)
return subsumes;
}
bool
AccessCheck::subsumes(JSObject *a, JSObject *b)
{
return subsumes(js::GetObjectCompartment(a), js::GetObjectCompartment(b));
}
// Same as above, but ignoring document.domain.
bool
AccessCheck::subsumesIgnoringDomain(JSCompartment *a, JSCompartment *b)
@ -382,6 +388,11 @@ ExposedPropertiesOnly::check(JSContext *cx, JSObject *wrapper, jsid id, Wrapper:
JSObject *hallpass = &exposedProps.toObject();
if (!AccessCheck::subsumes(js::UnwrapObject(hallpass), wrappedObject)) {
EnterAndThrow(cx, wrapper, "Invalid __exposedProps__");
return false;
}
Access access = NO_ACCESS;
JSPropertyDescriptor desc;

1
js/xpconnect/wrappers/AccessCheck.h
View File

@ -19,6 +19,7 @@ namespace xpc {
class AccessCheck {
public:
static bool subsumes(JSCompartment *a, JSCompartment *b);
static bool subsumes(JSObject *a, JSObject *b);
static bool wrapperSubsumes(JSObject *wrapper);
static bool subsumesIgnoringDomain(JSCompartment *a, JSCompartment *b);
static bool isChrome(JSCompartment *compartment);