1068614 - XrayResolveOwnProperty doesn't check if we're chrome before invoking XrayResolveUnforgeableProperty with nativeProperties.chromeOnly

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bobby Holley (:bholley)]

I just came across http://hg.mozilla.org/mozilla-central/file/641d450532be/dom/bindings/BindingUtils.cpp#l1013 , which looks bad to me at first glance. Am I missing something?

Comment 1

[Peter Van der Beken [:peterv]]

Should be fine for now, we don't have unforgeable chrome-only APIs.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I think I keep assuming Xrays means chrome... which it does, except for Location and Window.

I agree, this should be fixed.

Comment 3

[Bobby Holley (:bholley)]

(In reply to Boris Zbarsky [:bz] from comment #2)
> I think I keep assuming Xrays means chrome... which it does, except for
> Location and Window.

No, that's not the issue - the issue is same-origin Xrays (wantXrays) and nsExpandedPrincipal, neither of which should have access to chrome-only APIs.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Oh, sandboxes, right.  :(

Comment 5

[Bobby Holley (:bholley)]

Looks like peter's patch in bug 787070 fixes this. We should verify once that lands.

Comment 6

[Bobby Holley (:bholley)]

This was fixed by bug 787070.