336303 - [FIX]nsPrincipal::GetOrigin should dig into nested URIs

Status: RESOLVED FIXED

(Core :: Security, defect, P2)

Description

[Boris Zbarsky [:bzbarsky]]

That would allow us to remove the "ugly manual de-nesting of jar: in
nsScriptSecurityManager::LookupPolicy".

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

I checked the GetOrigin callers.  All except for GetCodebasePrincipal are just fine with this change; I believe GetCodebasePrincipal is fine too.

Comment 2

[Daniel Veditz [:dveditz]]

Comment on attachment 220558 [details] [diff] [review]
Proposed fix

presumably there's a caps/include/nsPrincipal.h patch that adds the mOrigin member?

r=dveditz

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Er, yes. ;)

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 220780 [details] [diff] [review]
Er, yes.  ;)

sr=jst

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: With all parts really there

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 7

[Daniel Veditz [:dveditz]]

Attachment: 1.8 branch version

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 308264 [details] [diff] [review]
1.8 branch version

Looks good. r+sr=bzbarsky

Comment 9

[Samuel Sidler (old account; do not CC)]

Comment on attachment 308264 [details] [diff] [review]
1.8 branch version

Approved for 1.8.1.13. a=ss

Comment 10

[Daniel Veditz [:dveditz]]

Fix checked into 1.8 branch

Comment 11

[Daniel Veditz [:dveditz]]

qa: this can be tested with the test case in bug 402995

Comment 12

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 308264 [details] [diff] [review]
1.8 branch version

a=caillon for the 1.8.0 branch

Comment 13

[Al Billings [:abillings - ex-MoCo]]

I verified bug 402995 using Firefox 2.0.0.12 on Ubuntu 7.10 with JRE 1.6.0_03-b05.
I then validated the fix for 402995 using Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.8.1.13) Gecko/2008031115 Firefox/2.0.0.13, which is the RC1 for 2.0.0.13.
The bug no longer reproduces in either of the jar: versions. 

Marking as verified for 1.8.1.13

Comment 14

[Reed Loden [:reed]]

MOZILLA_1_8_0_BRANCH:

Checking in caps/include/nsPrincipal.h;
/cvsroot/mozilla/caps/include/nsPrincipal.h,v  <--  nsPrincipal.h
new revision: 1.17.10.1; previous revision: 1.17
done
Checking in caps/src/nsPrincipal.cpp;
/cvsroot/mozilla/caps/src/nsPrincipal.cpp,v  <--  nsPrincipal.cpp
new revision: 1.37.2.1.2.2; previous revision: 1.37.2.1.2.1
done
Checking in caps/src/nsScriptSecurityManager.cpp;
/cvsroot/mozilla/caps/src/nsScriptSecurityManager.cpp,v  <--  nsScriptSecurityManager.cpp
new revision: 1.266.2.7.2.13; previous revision: 1.266.2.7.2.12
done