157574 - transformDocument needs same origin check

Status: VERIFIED FIXED

(Core :: XSLT, defect)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

From Jonas Sicking:
It is now possible to copy a document from another domain in js by doing

proc = new XSLTProcessor;
proc.transformDocument(otherDomainDoc,
                       myIdentityTransformation,
                       myResult,
                       null);

where 'myIdentityTransformation' is a XSLT stylesheet performing a
copy-transformation and 'otherDomainDoc' is a document from another domain.

Not sure if it is possible to simply walk the myResult document after this, but
it is at least possible to set up a treewalker before doing the above call and
then walking the document. It is probably also possible to set up mutationevent
listeners and get notifyed about all content that is inserted.


The way to fix this is to have a same-origin check for the source and stylesheet
documents in XSLTProcessor::TransformDocument so that this can only be done on
documents in the same origin as the current JS-context (if there is one)

Comment 1

[Peter Van der Beken [:peterv]]

I don't understand, you have a document (that you have access to), you copy it
with a transformation into a document (that you have access to) and ...? You can
just write a JS function to do exactly the same thing?

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

The problem is that you can access the document-node of documents of other
origins. This is neded for code such as 

myIFrame.contentDocument.location = "http://..."

Comment 3

[Peter Van der Beken [:peterv]]

The checkin for bug 155504 fixed this, right?

Comment 4

[Peter Van der Beken [:peterv]]

er, bug 156452 is what I meant.

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

yep

Comment 6

[Axel Hecht]

mass verifying