79544 - JS error when bringing up Composer

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect)

Description

[Simon Fraser [no longer active]]

I get this JS error when bringing up composer:

************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "Permission denied to create wrapper for object
[nsIDocumentStateListener::NotifyDocumentCreated]"  nsresult: "0x8057001e
(NS_ERROR_XPC_JS_THREW_STRING)"  location: "<unknown>"  data: no]
************************************************************

This is probably jst DOM fallout.

Comment 1

[Simon Fraser [no longer active]]

Note that this causes a bunch of our toolbar items to remain disabled.

Comment 2

[Simon Fraser [no longer active]]

It seems that something that is called from NotifyDocumentCreated is doing 
something bad. Control does reach the start of that JS function.

Comment 3

[John Bandhauer]

This looks like a caps problem to me. DumpJSStack() in the debugger shows the 
stack below at a point where the caps system is disallowing the creation of a 
wrapper (I'm not certain if this is the same case that causes the error in the 
JS console).

A breakpoint at the failure return in 
nsScriptSecurityManager::CheckXPCPermissions will catch such failure cases.

Why would this be disallowed when the first JS frame on the stack is running in 
chrome?

0 [native frame]
1 GetEditorController() ["chrome://editor/content/ComposerCommands.js":188]
    numControllers = 3
    i = 0
    commandManager = null
    controller = undefined
    interfaceRequestor = undefined
    this = [xpconnect wrapped Window @ 0x3fb0520]
2 SetupHTMLEditorCommands() ["chrome://editor/content/ComposerCommands.js":34]
    controller = undefined
    this = [xpconnect wrapped Window @ 0x3fb0520]
3 EditorSharedStartup() ["chrome://editor/content/editor.js":207]
    tableKey = undefined
    dragStr = undefined
    clickStr = undefined
    delStr = undefined
    BrowserColors = undefined
    this = [xpconnect wrapped Window @ 0x3fb0520]
4 EditorStartup(editorType = "html", editorElement = [xpconnect wrapped XULElem
nt @ 0x4838c10]) ["chrome://editor/content/editor.js":186]
    url = undefined
    this = [xpconnect wrapped Window @ 0x3fb0520]
5 EditorOnLoad() ["chrome://editor/content/editor.js":92]
    this = [xpconnect wrapped Window @ 0x3fb0520]
6 onload(event = [xpconnect wrapped Event @ 0x48fc400]) ["<unknown>":0]
    this = [xpconnect wrapped Window @ 0x3fb0520]
7 <TOP LEVEL> ["<unknown>":0]

Comment 4

[Simon Fraser [no longer active]]

Some dump()s in this JS show that this line fails:

    var newdoctype = domdoc.implementation.createDocumentType("html",
"-//W3C//DTD HTML 4.01 Transitional//EN","");
line 1682 of editor.js.

Comment 5

[Simon Fraser [no longer active]]

It seems to return from the createDocumentType() call cleanly, but I never reach
the next line of JS. Something that may be a contributing factor is that the
object that createDocumentType returns is a nsIDOMDocumentType, which inherits
from nsIDOMNode. Do we have some kind of issue with security and inheritance?

Comment 6

[Simon Fraser [no longer active]]

The class for which we are getting a security check failure is actually 
nsDOMDocumentType.

Comment 7

[Simon Fraser [no longer active]]

over to jst

Comment 8

[Johnny Stenback (:jst)]

Nice catch, DocumentType was missing it's classinfo line in it's QI map. Problem
fixed.

Comment 9

[Johnny Stenback (:jst)]

Reopening since the toolbars are still disabled.

Comment 10

[John Bandhauer]

When I try to bring up composer I see permission denied to create wrappers for:
 nsDOMWindowController
 nsComposerWindowController
 nsEditorController


  

Comment 11

[Simon Fraser [no longer active]]

Right. The problem here seems to be a security manager one. The JS is doing 

      var controller = window._content.controllers.getControllerAt(i);
      var interfaceRequestor = 
controller.QueryInterface(Components.interfaces.nsIInterfaceRequestor);
      if (!interfaceRequestor) continue;
    
      commandManager = 
interfaceRequestor.getInterface(Components.interfaces.nsIControllerCommandManager
);

but since this JS runs on XUL, there should not be any security issues. jst says 
that mstoltz has some bugs about messing with stuff on _content from XUL, and 
this is one of them. We verified that everything works if you disable the 
security manager.

Comment 12

[Simon Fraser [no longer active]]

Blocker for composer.

Comment 13

[Mitchell Stoltz (not reading bugmail)]

We checked in a temporary workaround.

Comment 14

[ckritzer (gone)]

Marking VERIFIED FIXED on:
-MacOS91 2001-05-30-09-trunk
-Win98SE 2001-05-30-09-trunk
-LinRH62 2001-05-30-08-trunk