wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 730792 - Enable new security checks for updates without the service. r=rstrong

Browse Source
This commit is contained in:
Brian R. Bondy 2012-03-05 15:47:46 -05:00
parent 7a69f7d85d
commit f054840ac4
3 changed files with 22 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/libmar/tests/unit/test_sign_verify.js
View File

@ -57,8 +57,7 @@ function run_test() {
// The XPCShell test wiki indicates this is the preferred way for
// Windows detection.
var isWindows = ("@mozilla.org/windows-registry-key;1"
in Cc);
var isWindows = ("@mozilla.org/windows-registry-key;1" in Cc);
// Setup the command line arguments to create the MAR.
// Windows vs. Linux/Mac/... have different command line for verification

18
toolkit/mozapps/update/nsUpdateService.js
View File

@ -151,15 +151,6 @@ const SERVICE_UPDATER_IDENTITY_ERROR = 16004;
const SERVICE_STILL_APPLYING_ON_SUCCESS = 16005;
const SERVICE_STILL_APPLYING_ON_FAILURE = 16006;
// Updater MAR security errors
const CERT_LOAD_ERROR = 17;
const CERT_HANDLING_ERROR = 18;
const CERT_VERIFY_ERROR = 19;
const ARCHIVE_NOT_OPEN = 20;
const COULD_NOT_READ_PRODUCT_INFO_BLOCK_ERROR = 21;
const MAR_CHANNEL_MISMATCH_ERROR = 22;
const VERSION_DOWNGRADE_ERROR = 23;
const CERT_ATTR_CHECK_FAILED_NO_UPDATE = 100;
const CERT_ATTR_CHECK_FAILED_HAS_UPDATE = 101;
const BACKGROUNDCHECK_MULTIPLE_FAILURES = 110;
@ -1424,14 +1415,7 @@ UpdateService.prototype = {
update.errorCode == SERVICE_UPDATER_COMPARE_ERROR ||
update.errorCode == SERVICE_UPDATER_IDENTITY_ERROR ||
update.errorCode == SERVICE_STILL_APPLYING_ON_SUCCESS ||
update.errorCode == SERVICE_STILL_APPLYING_ON_FAILURE ||
update.errorCode == CERT_LOAD_ERROR ||
update.errorCode == CERT_HANDLING_ERROR ||
update.errorCode == CERT_VERIFY_ERROR ||
update.errorCode == ARCHIVE_NOT_OPEN ||
update.errorCode == COULD_NOT_READ_PRODUCT_INFO_BLOCK_ERROR ||
update.errorCode == MAR_CHANNEL_MISMATCH_ERROR ||
update.errorCode == VERSION_DOWNGRADE_ERROR) {
update.errorCode == SERVICE_STILL_APPLYING_ON_FAILURE) {
var failCount = getPref("getIntPref",
PREF_APP_UPDATE_SERVICE_ERRORS, 0);
var maxFail = getPref("getIntPref",

56
toolkit/mozapps/update/updater/updater.cpp
View File

@ -1563,23 +1563,9 @@ ReadMARChannelIDs(const NS_tchar *path, MARChannelStringTable *results)
return result;
}
struct UpdateThreadData
{
UpdateThreadData(bool performMARChecks) :
mPerformMARChecks(performMARChecks)
{
}
bool mPerformMARChecks;
};
static void
UpdateThreadFunc(void *param)
{
UpdateThreadData *threadData = reinterpret_cast<UpdateThreadData*>(param);
bool performMARChecks = threadData && threadData->mPerformMARChecks;
delete threadData;
// open ZIP archive and process...
int rv;
NS_tchar dataFile[MAXPATHLEN];
@ -1588,30 +1574,28 @@ UpdateThreadFunc(void *param)
rv = gArchiveReader.Open(dataFile);
if (performMARChecks) {
#ifdef MOZ_VERIFY_MAR_SIGNATURE
if (rv == OK) {
rv = gArchiveReader.VerifySignature();
}
if (rv == OK) {
NS_tchar updateSettingsPath[MAX_TEXT_LEN];
NS_tsnprintf(updateSettingsPath,
sizeof(updateSettingsPath) / sizeof(updateSettingsPath[0]),
NS_T("%supdate-settings.ini"), gDestPath);
MARChannelStringTable MARStrings;
if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) {
// If we can't read from update-settings.ini then we shouldn't impose
// a MAR restriction. Some installations won't even include this file.
MARStrings.MARChannelID[0] = '\0';
}
rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID,
MOZ_APP_VERSION);
}
#endif
if (rv == OK) {
rv = gArchiveReader.VerifySignature();
}
if (rv == OK) {
NS_tchar updateSettingsPath[MAX_TEXT_LEN];
NS_tsnprintf(updateSettingsPath,
sizeof(updateSettingsPath) / sizeof(updateSettingsPath[0]),
NS_T("%supdate-settings.ini"), gDestPath);
MARChannelStringTable MARStrings;
if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) {
// If we can't read from update-settings.ini then we shouldn't impose
// a MAR restriction. Some installations won't even include this file.
MARStrings.MARChannelID[0] = '\0';
}
rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID,
MOZ_APP_VERSION);
}
#endif
if (rv == OK) {
rv = DoUpdate();
gArchiveReader.Close();
@ -2123,7 +2107,7 @@ int NS_main(int argc, NS_tchar **argv)
// before QuitProgressUI has been called, so wait for UpdateThreadFunc to
// terminate.
Thread t;
if (t.Run(UpdateThreadFunc, new UpdateThreadData(usingService)) == 0) {
if (t.Run(UpdateThreadFunc, NULL) == 0) {
ShowProgressUI();
}
t.Join();