mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
84aefeb108
Now that XBL scopes are here to stay (no more pref), we can remove all the machinery that makes SOWs dynamic. We still need SOWs until bug 825392 is fixed, but they can now be totally opaque. One side effect of this patch is that, due to our usage of Opaque, we now allow CALL on SOWs. But this shouldn't be a problem, because SOWs are used for anonymous elements which are not callable (and we probably wouldn't mind it even if they were).
114 lines
3.9 KiB
C++
114 lines
3.9 KiB
C++
/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
|
|
* vim: set ts=4 sw=4 et tw=99 ft=cpp:
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#ifndef __AccessCheck_h__
|
|
#define __AccessCheck_h__
|
|
|
|
#include "jsapi.h"
|
|
#include "jswrapper.h"
|
|
#include "WrapperFactory.h"
|
|
|
|
class nsIPrincipal;
|
|
|
|
namespace xpc {
|
|
|
|
class AccessCheck {
|
|
public:
|
|
static bool subsumes(JSCompartment *a, JSCompartment *b);
|
|
static bool subsumes(JSObject *a, JSObject *b);
|
|
static bool wrapperSubsumes(JSObject *wrapper);
|
|
static bool subsumesIgnoringDomain(JSCompartment *a, JSCompartment *b);
|
|
static bool isChrome(JSCompartment *compartment);
|
|
static bool isChrome(JSObject *obj);
|
|
static bool callerIsChrome();
|
|
static nsIPrincipal *getPrincipal(JSCompartment *compartment);
|
|
static bool isCrossOriginAccessPermitted(JSContext *cx, JSObject *obj, jsid id,
|
|
js::Wrapper::Action act);
|
|
|
|
static bool needsSystemOnlyWrapper(JSObject *obj);
|
|
};
|
|
|
|
struct Policy {
|
|
};
|
|
|
|
// This policy only allows calling the underlying callable. All other operations throw.
|
|
struct Opaque : public Policy {
|
|
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act) {
|
|
return act == js::Wrapper::CALL;
|
|
}
|
|
static bool deny(js::Wrapper::Action act) {
|
|
return false;
|
|
}
|
|
static bool allowNativeCall(JSContext *cx, JS::IsAcceptableThis test, JS::NativeImpl impl)
|
|
{
|
|
return false;
|
|
}
|
|
};
|
|
|
|
// This policy is designed to protect privileged callers from untrusted non-
|
|
// Xrayable objects. Nothing is allowed, and nothing throws.
|
|
struct GentlyOpaque : public Policy {
|
|
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act) {
|
|
return false;
|
|
}
|
|
static bool deny(js::Wrapper::Action act) {
|
|
return true;
|
|
}
|
|
static bool allowNativeCall(JSContext *cx, JS::IsAcceptableThis test, JS::NativeImpl impl)
|
|
{
|
|
// We allow nativeCall here because the alternative is throwing (which
|
|
// happens in SecurityWrapper::nativeCall), which we don't want. There's
|
|
// unlikely to be too much harm to letting this through, because this
|
|
// wrapper is only used to wrap less-privileged objects in more-privileged
|
|
// scopes, so unwrapping here only drops privileges.
|
|
return true;
|
|
}
|
|
};
|
|
|
|
// This policy only permits access to properties that are safe to be used
|
|
// across origins.
|
|
struct CrossOriginAccessiblePropertiesOnly : public Policy {
|
|
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act) {
|
|
return AccessCheck::isCrossOriginAccessPermitted(cx, wrapper, id, act);
|
|
}
|
|
static bool deny(js::Wrapper::Action act) {
|
|
return false;
|
|
}
|
|
static bool allowNativeCall(JSContext *cx, JS::IsAcceptableThis test, JS::NativeImpl impl)
|
|
{
|
|
return false;
|
|
}
|
|
};
|
|
|
|
// This policy only permits access to properties if they appear in the
|
|
// objects exposed properties list.
|
|
struct ExposedPropertiesOnly : public Policy {
|
|
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act);
|
|
|
|
static bool deny(js::Wrapper::Action act) {
|
|
// Fail silently for GETs.
|
|
return act == js::Wrapper::GET;
|
|
}
|
|
static bool allowNativeCall(JSContext *cx, JS::IsAcceptableThis test, JS::NativeImpl impl);
|
|
};
|
|
|
|
// Components specific policy
|
|
struct ComponentsObjectPolicy : public Policy {
|
|
static bool check(JSContext *cx, JSObject *wrapper, jsid id, js::Wrapper::Action act);
|
|
|
|
static bool deny(js::Wrapper::Action act) {
|
|
return false;
|
|
}
|
|
static bool allowNativeCall(JSContext *cx, JS::IsAcceptableThis test, JS::NativeImpl impl) {
|
|
return false;
|
|
}
|
|
};
|
|
|
|
}
|
|
|
|
#endif /* __AccessCheck_h__ */
|