14520 - jsloader should not expose 'raw' component manager into JS

Status: RESOLVED WONTFIX

(Core :: XPConnect, defect, P3)

Description

[John Bandhauer]

in http://bugzilla.mozilla.org/show_bug.cgi?id=13619 we have a plan for a
scheme to build a component manager proxy to be exposed into JS so that security
filtering can be done consistently.

The JSLoader does its own wrapping of the raw component manager and reflects it
into JS as needed to do the NSGetModule call. xpconnect could expose the proxied
component manager and the js loader could use that.

Though we may have no specific security plans for JS components, we should plug
all potential holes and route all calls through safe channels.

Comment 1

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

OK, I'll switch over when the proxy is available, presumably from the XPConnect
service.

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Let's try that again, shall we?

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Any news on how I should get the One True Component Manager?  Just a
get-property on the Components object, maybe?

Do we need this for beta?  I'll say ``yes'' for now.

Comment 4

[chris hofmann]

say yes or remove beta from the title. -> m12

Comment 5

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Is there a way to get The One True Component Manager Wrapper yet?

Comment 6

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

There's no good way to get the Component Manager wrapper other than
JS_GetProperty for Components.manager, and our current security policy makes it
currently pointless, so I'm punting to M13 and the completion of the XPConnect
reconstruction.

Comment 7

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Setting "no target milestone" to match my dependency (13619).

Comment 8

[leger]

Moving all XPConnect QA contact to rginda

Comment 9

[leger]

Due to Beta indication in Summary, putting beta1 into keyword field.

Comment 10

[rickg]

Marking pdt-, but we'd like to have it.

Comment 11

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

I'm going to throw this at jband, who I know will throw it back at me as soon as
his part is done.

Comment 12

[John Bandhauer]

mass reassign of xpconnect bugs to [e-mail]

Comment 13

[David Bradley]

Removing Rob as QA contact