Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-03 12:35:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Restrict who can claim to implement nsISecurityCheckedComponent. bug 352882, r=jst sr=bzbarsky

Browse Source
This commit is contained in:
mrbkap@gmail.com 2007-06-15 14:44:51 -07:00
parent 10f8641377
commit cc6bf46a9e
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
js/src/xpconnect/src/xpcwrappedjsclass.cpp
View File

@ -593,6 +593,44 @@ nsXPCWrappedJSClass::DelegatedQueryInterface(nsXPCWrappedJS* self,
// else we do the more expensive stuff...
#ifndef XPCONNECT_STANDALONE
// Before calling out, ensure that we're not about to claim to implement
// nsISecurityCheckedComponent for an untrusted object. Doing so causes
// problems. See bug 352882.
if(aIID.Equals(NS_GET_IID(nsISecurityCheckedComponent)))
{
// XXX This code checks to see if the given object has chrome (also
// known as system) principals. It really wants to do a
// UniversalXPConnect type check.
nsXPConnect *xpc = nsXPConnect::GetXPConnect();
nsCOMPtr<nsIScriptSecurityManager> secMan =
do_QueryInterface(xpc->GetDefaultSecurityManager());
if(!secMan)
{
*aInstancePtr = nsnull;
return NS_NOINTERFACE;
}
nsCOMPtr<nsIPrincipal> objPrin;
nsresult rv = secMan->GetObjectPrincipal(ccx, self->GetJSObject(),
getter_AddRefs(objPrin));
if(NS_SUCCEEDED(rv))
{
nsCOMPtr<nsIPrincipal> systemPrin;
rv = secMan->GetSystemPrincipal(getter_AddRefs(systemPrin));
if(systemPrin != objPrin)
rv = NS_NOINTERFACE;
}
if(NS_FAILED(rv))
{
*aInstancePtr = nsnull;
return rv;
}
}
#endif
// check if the JSObject claims to implement this interface
JSObject* jsobj = CallQueryInterfaceOnJSObject(ccx, self->GetJSObject(),
aIID);