diff --git a/content/xbl/src/nsXBLService.cpp b/content/xbl/src/nsXBLService.cpp index f9c76ee663b..35d6ff20807 100644 --- a/content/xbl/src/nsXBLService.cpp +++ b/content/xbl/src/nsXBLService.cpp @@ -1103,6 +1103,25 @@ nsXBLService::LoadBindingDocumentInfo(nsIContent* aBoundElement, nsIContentPolicy::TYPE_XBL, aBoundDocument); NS_ENSURE_SUCCESS(rv, rv); + + // Also make sure that we're same-origin with the bound document + // except if the stylesheet is a UA stylesheet. We fake testing + // for UA stylesheets by calling CheckLoadURI. + nsCOMPtr principalURI; + rv = aOriginPrincipal->GetURI(getter_AddRefs(principalURI)); + NS_ENSURE_SUCCESS(rv, rv); + + if (principalURI) { + nsresult uaCheckRes = + nsContentUtils::GetSecurityManager()-> + CheckLoadURIWithPrincipal(aBoundDocument->NodePrincipal(), + principalURI, 0); + if (NS_SUCCEEDED(uaCheckRes)) { + rv = aBoundDocument->NodePrincipal()->CheckMayLoad(aBindingURI, + PR_TRUE); + NS_ENSURE_SUCCESS(rv, rv); + } + } } *aResult = nsnull; diff --git a/content/xbl/test/Makefile.in b/content/xbl/test/Makefile.in index f2dd3cb4ab3..73954c12ad9 100644 --- a/content/xbl/test/Makefile.in +++ b/content/xbl/test/Makefile.in @@ -67,6 +67,9 @@ _TEST_FILES = \ file_bug379959_cross.html \ file_bug379959_xbl.xml \ test_bug468210.xhtml \ + test_bug481558.html \ + file_bug481558css.sjs \ + file_bug481558.xbl \ $(NULL) libs:: $(_TEST_FILES) diff --git a/content/xbl/test/file_bug481558.xbl b/content/xbl/test/file_bug481558.xbl new file mode 100644 index 00000000000..1d6d305eddc --- /dev/null +++ b/content/xbl/test/file_bug481558.xbl @@ -0,0 +1,13 @@ + + + + + Binding Attached + + + + + + diff --git a/content/xbl/test/file_bug481558css.sjs b/content/xbl/test/file_bug481558css.sjs new file mode 100644 index 00000000000..a4b53337d3d --- /dev/null +++ b/content/xbl/test/file_bug481558css.sjs @@ -0,0 +1,17 @@ +function handleRequest(request, response) +{ + var query = {}; + request.queryString.split('&').forEach(function (val) { + [name, value] = val.split('='); + query[name] = unescape(value); + }); + + response.setHeader("Content-Type", "text/css", false); + css = "#" + query.id + " { -moz-binding: url(\""; + if (query.server) { + css += "http://" + query.server + "/tests/content/xbl/test/"; + } + css += "file_bug481558.xbl#test\"); }"; + + response.write(css); +} diff --git a/content/xbl/test/test_bug481558.html b/content/xbl/test/test_bug481558.html new file mode 100644 index 00000000000..92389f566c0 --- /dev/null +++ b/content/xbl/test/test_bug481558.html @@ -0,0 +1,39 @@ + + + + + Test for Bug 481558 + + + + + + + + + +Mozilla Bug 481558 +

+

+

+

+
+
+
+ +