/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ /* Defines the abstract interface for a principal. */ #include "nsISerializable.idl" %{C++ struct JSContext; struct JSPrincipals; #include "nsCOMPtr.h" #include "nsTArray.h" %} interface nsIURI; interface nsIContentSecurityPolicy; [ptr] native JSContext(JSContext); [ptr] native JSPrincipals(JSPrincipals); [ptr] native PrincipalArray(nsTArray >); [scriptable, uuid(6df7d16d-5b26-42a1-b1f7-069d46c37aa8)] interface nsIPrincipal : nsISerializable { /** * Values of capabilities for each principal. Order is * significant: if an operation is performed on a set * of capabilities, the minimum is computed. */ const short ENABLE_DENIED = 1; const short ENABLE_UNKNOWN = 2; const short ENABLE_WITH_USER_PERMISSION = 3; const short ENABLE_GRANTED = 4; /** * Returns the security preferences associated with this principal. * prefBranch will be set to the pref branch to which these preferences * pertain. id is a pseudo-unique identifier, pertaining to either the * fingerprint or the origin. subjectName is a name that identifies the * entity this principal represents (may be empty). grantedList and * deniedList are space-separated lists of capabilities which were * explicitly granted or denied by a pref. isTrusted is a boolean that * indicates whether this is a codebaseTrusted certificate. */ void getPreferences(out string prefBranch, out string id, out string subjectName, out string grantedList, out string deniedList, out boolean isTrusted); /** * Returns whether the other principal is equivalent to this principal. * Principals are considered equal if they are the same principal, * they have the same origin, or have the same certificate fingerprint ID */ boolean equals(in nsIPrincipal other); /** * Like equals, but doesn't take document.domain changes into account. */ boolean equalsIgnoringDomain(in nsIPrincipal other); /** * Returns a hash value for the principal. */ [noscript] readonly attribute unsigned long hashValue; /** * The domain security policy of the principal. */ // XXXcaa should this be here? The script security manager is the only // thing that should care about this. Wouldn't storing this data in one // of the hashtables in nsScriptSecurityManager be better? // XXXbz why is this writable? Who should have write access to this? What // happens if this principal is in our hashtable and we pass it out of the // security manager and someone writes to this field? Especially if they // write garbage? If we need to give someone other than the security // manager a way to set this (which I question, since it can increase the // permissions of a page) it should be a |void clearSecurityPolicy()| // method. [noscript] attribute voidPtr securityPolicy; // XXXcaa probably should be turned into {get|set}CapabilityFlags // XXXbz again, what if this lives in our hashtable and someone // messes with it? Is that OK? [noscript] short canEnableCapability(in string capability); [noscript] boolean isCapabilityEnabled(in string capability, in voidPtr annotation); [noscript] void enableCapability(in string capability, inout voidPtr annotation); /** * The codebase URI to which this principal pertains. This is * generally the document URI. */ readonly attribute nsIURI URI; /** * The domain URI to which this principal pertains. * This is congruent with HTMLDocument.domain, and may be null. * Setting this has no effect on the URI. */ [noscript] attribute nsIURI domain; /** * The origin of this principal's codebase URI. * An origin is defined as: scheme + host + port. */ // XXXcaa this should probably be turned into an nsIURI. // The system principal's origin should be some caps namespace // with a chrome URI. All of chrome should probably be the same. readonly attribute string origin; /** * Whether this principal is associated with a certificate. */ readonly attribute boolean hasCertificate; /** * The fingerprint ID of this principal's certificate. * Throws if there is no certificate associated with this principal. */ // XXXcaa kaie says this may not be unique. We should probably // consider using something else for this.... readonly attribute AUTF8String fingerprint; /** * The pretty name for the certificate. This sort of (but not really) * identifies the subject of the certificate (the entity that stands behind * the certificate). Note that this may be empty; prefer to get the * certificate itself and get this information from it, since that may * provide more information. * * Throws if there is no certificate associated with this principal. */ readonly attribute AUTF8String prettyName; /** * Returns whether the other principal is equal to or weaker than this * principal. Principals are equal if they are the same object, they * have the same origin, or they have the same certificate ID. * * Thus a principal always subsumes itself. * * The system principal subsumes itself and all other principals. * * A null principal (corresponding to an unknown, hence assumed minimally * privileged, security context) is not equal to any other principal * (including other null principals), and therefore does not subsume * anything but itself. * * Both codebase and certificate principals are subsumed by the system * principal, but no codebase or certificate principal yet subsumes any * other codebase or certificate principal. This may change in a future * release; note that nsIPrincipal is unfrozen, not slated to be frozen. * * XXXbz except see bug 147145! * * Note for the future: Perhaps we should consider a certificate principal * for a given URI subsuming a codebase principal for the same URI? Not * sure what the immediate benefit would be, but I think the setup could * make some code (e.g. MaybeDowngradeToCodebase) clearer. */ boolean subsumes(in nsIPrincipal other); /** * Same as the previous method, subsumes(), but for codebase principals * ignores changes to document.domain. */ boolean subsumesIgnoringDomain(in nsIPrincipal other); /** * Checks whether this principal is allowed to load the network resource * located at the given URI under the same-origin policy. This means that * codebase principals are only allowed to load resources from the same * domain, the system principal is allowed to load anything, and null * principals are not allowed to load anything. * * If the load is allowed this function does nothing. If the load is not * allowed the function throws NS_ERROR_DOM_BAD_URI. * * NOTE: Other policies might override this, such as the Access-Control * specification. * NOTE: The 'domain' attribute has no effect on the behaviour of this * function. * * * @param uri The URI about to be loaded. * @param report If true, will report a warning to the console service * if the load is not allowed. * @throws NS_ERROR_DOM_BAD_URI if the load is not allowed. */ void checkMayLoad(in nsIURI uri, in boolean report); /** * The subject name for the certificate. This actually identifies the * subject of the certificate. This may well not be a string that would * mean much to a typical user on its own (e.g. it may have a number of * different names all concatenated together with some information on what * they mean in between). * * Throws if there is no certificate associated with this principal. */ readonly attribute AUTF8String subjectName; /** * The certificate associated with this principal, if any. If there isn't * one, this will return null. Getting this attribute never throws. */ readonly attribute nsISupports certificate; /** * A Content Security Policy associated with this principal. */ [noscript] attribute nsIContentSecurityPolicy csp; /** * Returns the extended origin of the principal. * The extended origin is a string that has more information than the origin * and can be used to isolate data or permissions between different * principals while taking into account parameters like the app id or the * fact that the principal is embedded in a mozbrowser. * Some principals will return the origin for extendedOrigin. * Some principals will assert if you try to access the extendedOrigin. * * The extendedOrigin is intended to be an opaque identifier. It is * currently "human-readable" but no callers should assume it will stay * as is and it might be crypto-hashed at some point. */ readonly attribute AUTF8String extendedOrigin; const short APP_STATUS_NOT_INSTALLED = 0; const short APP_STATUS_INSTALLED = 1; const short APP_STATUS_PRIVILEGED = 2; const short APP_STATUS_CERTIFIED = 3; /** * Shows the status of the app. * Can be: APP_STATUS_NOT_INSTALLED, APP_STATUS_INSTALLED, * APP_STATUS_PRIVILEGED or APP_STATUS_CERTIFIED. */ readonly attribute unsigned short appStatus; %{C++ PRUint16 GetAppStatus() { PRUint16 appStatus; nsresult rv = GetAppStatus(&appStatus); if (NS_FAILED(rv)) { return APP_STATUS_NOT_INSTALLED; } return appStatus; } %} /** * Returns the app id the principal is in, or returns * nsIScriptSecurityManager::NO_APP_ID if this principal isn't part of an * app. */ readonly attribute unsigned long appId; /** * Returns true iif the principal is inside a browser element. */ readonly attribute boolean isInBrowserElement; }; /** * If nsSystemPrincipal is too risky to use, but we want a principal to access * more than one origin, nsExpandedPrincipals letting us define an array of * principals it subsumes. So script with an nsExpandedPrincipals will gain * same origin access when at least one of its principals it contains gained * sameorigin acccess. An nsExpandedPrincipal will be subsumed by the system * principal, and by another nsExpandedPrincipal that has all its principals. * It is added for jetpack content-scripts to let them interact with the * content and a well defined set of other domains, without the risk of * leaking out a system principal to the content. See: Bug 734891 */ [uuid(f3e177Df-6a5e-489f-80a7-2dd1481471d8)] interface nsIExpandedPrincipal : nsISupports { /** * An array of principals that the expanded principal subsumes. * Note: this list is not reference counted, it is shared, so * should not be changed and should only be used ephemerally. */ [notxpcom] readonly attribute PrincipalArray whiteList; };