131025 - Remove "trusted codebase" mechanism

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[Mitchell Stoltz (not reading bugmail)]

In November I added a mechanism for allowing unsigned content to enable
privileges without enabling codebase principals generally. This isn't really a
safe thing to do - it means we're trusting DNS to verify the identity of a
remote site, and DNS isn't meant to be a secure verification of identity. This
feature was checked in as a temporary measure, and I'd like to remove it now so
as to encourace the use of more secure methods (signed scripts).

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch - also includes some other fixes

Here's a fix for this bug, and these others:
128861, 131342, 131340, 128697.

Comment 2

[Johnny Stenback (:jst)]

replace |new PLDHashTable()| with PL_NewHashTable() and call
PL_DHashTableDestroy() to destroy a pldhash in stead of deleting it.

+                    if (myScheme.Equals("http"))
+                        defaultPort = 80;

What about "https"?

+NS_NAMED_LITERAL_CSTRING(sPolicyPrefix, "capability.policy.");

Make this static.

With that, sr=jst

Comment 3

[harishd]

Comment on attachment 74465 [details] [diff] [review]
Patch - also includes some other fixes

>@@ -403,6 +408,7 @@
>     PRBool mIsWritingPrefs;
>     nsCOMPtr<nsIThreadJSContextStack> mJSContextStack;
>     PRBool mNameSetRegistered;
>+    PRBool mPolicyPrefsChanged;
> };
Can you replace PRBool with PRPackedBool?


>+    nsCOMPtr<nsIURI> myBaseURI(mURI);
>+    while((jarURI = do_QueryInterface(myBaseURI)))
>+    {
>+        jarURI->GetJARFile(getter_AddRefs(myBaseURI));
>+    }

Are you sure myBaseURI will always be a valid memory? If yes then please add
a comment supporting that.

>+                        nsCOMPtr<nsIIOService> ioService(
>+                            do_GetService(NS_IOSERVICE_CONTRACTID));
>+                        if (!ioService)
>+                            return rv;

What is rv here? Shouldn't this be do_GetService(NS_IOSERVICE_CONTRACTID,
&rv)); or something
like that?

Comment 4

[harishd]

>+        else if (otherScheme.Equals("imap")    ||
>+
             otherScheme.Equals("mailbox") ||
>+                 otherScheme.Equals("news"))

Correct the indendation.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch 2, with changes

This incorporates the above comments.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Comment on attachment 74865 [details] [diff] [review]
Patch 2, with changes

With those changes, I'm going to assume I have r and sr.

Comment 7

[Asa Dotzler [:asa]]

Comment on attachment 74865 [details] [diff] [review]
Patch 2, with changes

a=asa (on behalf of drivers) for checkin to the 1.0 trunk

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Checked in on trunk. Would like to check this into the 0.9.9 branch too.

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Never mind, fix for 0.9.9 is not needed. Marking fixed.

Comment 10

[bsharma]

Marking verified as per above developer comments.