181934 - unable to access documentElement from signed script

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect)

Description

[Chris Waterson]

The following script works fine when run from an unsigned script, but fails with
an exception ("Permission denied to get property XMLDocument.documentElement")
when run from a signed script:

  function doit() {
    var requestBody =
      document.implementation.createDocument("", "data", null);

    requestBody.documentElement.appendChild(document.createTextNode("blah"));
  }

I've dug into it a little bit, and it appears that
nsScriptSecurityManager::CheckJSFunctionCallerAccess is receiving JSVAL_NULL as
the value of "vp", and is not able to handle this case.  fun_getProperty
(jsfun.c:932) will explicitly send JSVAL_NULL in some cases which I can't
pretend to understand.

Test case anon.

Comment 1

[Chris Waterson]

Attachment: test case, not in a JAR file (works)

This is the base test case, when run outside of a signed JAR file, ought to
work just fine (i.e., no exception on JS console).

Comment 2

[Chris Waterson]

Attachment: Signed JAR file containing bug.html

Comment 3

[Chris Waterson]

Either save the above JAR file locally, or use this URL to run bug.html from b.m.o:

jar:http://bugzilla.mozilla.org/attachment.cgi?id=107415&action=view!/bug.html

When you press the button, you'll see the following on the JS console: "Error:
uncaught exception: Permission denied to get property
XMLDocument.documentElement", which is silly.

Comment 4

[Chris Waterson]

Attachment: self-signing cert used to sign app

If you want, you can install this self-signed cert, but it ought to be
irrelevant to the problem at hand.

Comment 5

[Chris Waterson]

Possibly related to bug 119529?

Comment 6

[Brendan Eich [:brendan]]

Attachment: proposed fix

The other call to rt->checkObjectAccess, in jsexn.c, uses !JSVAL_IS_PRIMITIVE
to ensure that *vp refers to an object.  Can someone test this patch?  I bet
waterson no longer has a mozilla tree to update and build.  Thanks,

/be

Comment 7

[Chris Waterson]

brendan, your patch gets me past the assert-botch, and gets things working when 
I run the JAR'd test case from a "file:" URL.  However, there appear to be 
further problems when running from an "http:" URL (e.g., clicking on the 
attachment link above).

I'll file a separate bug on that.

Comment 8

[Chris Waterson]

Filed bug 182069 as a follow-on.

Comment 9

[Brendan Eich [:brendan]]

Fix checked in.

/be