1146544 - stylesheet/utils.js causes unsafe CPOW usage warnings

Status: RESOLVED INCOMPLETE

(Add-on SDK Graveyard :: General, defect, P1)

Description

[Mike Conley (:mconley) (:⚙️)]

function getDOMWindowUtils(window) {
  return window.QueryInterface(Ci.nsIInterfaceRequestor).
                getInterface(Ci.nsIDOMWindowUtils); <-- causes unsafe CPOW usage
};

function loadSheet(window, url, type) {
  if (!(type && type in SHEET_TYPE))
    type = "author";

  type = SHEET_TYPE[type];

  if (url instanceof Ci.nsIURI)
    url = url.spec;

  let winUtils = getDOMWindowUtils(window);
  try {
    winUtils.loadSheetUsingURIString(url, winUtils[type]); <-- causes unsafe CPOW usage
  }
  catch (e) {};
};

function removeSheet(window, url, type) {
  if (!(type && type in SHEET_TYPE))
    type = "author";

  type = SHEET_TYPE[type];

  if (url instanceof Ci.nsIURI)
    url = url.spec;

  let winUtils = getDOMWindowUtils(window);

  try {
    winUtils.removeSheetUsingURIString(url, winUtils[type]); <-- causes unsafe CPOW usage
  }
  catch (e) {};
};

Comment 1

[Dave Townsend [:mossop]]

It would be helpful to include details on how you're seeing this code be called

Comment 2

[Mike Conley (:mconley) (:⚙️)]

I believe this test triggers it:

https://hg.mozilla.org/mozilla-central/file/e730012260a4/addon-sdk/source/test/test-tabs-common.js#l557

Comment 3

[Mike Conley (:mconley) (:⚙️)]

While it looks like it's a test triggering it, stylesheet/utils.js is used elsewhere in the SDK (by the devtools inspector.js and highlighter.js, it seems), and can be used by any add-on.

We should probably make this API cpow-safe, or deprecate it.

Comment 4

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1399562