203211 - [FIXr]pay attention to content-policies when loading XSLT stylesheets (nsIContentPolicy)

Status: RESOLVED FIXED

(Core :: XSLT, defect, P2)

Description

[Axel Hecht]

bz asked us to ask the content policies when loading XSLT stylesheets.
Marking deps on the nsIContentPolicy API bug for starters.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Somewhat like this

Comment 2

[Peter Van der Beken [:peterv]]

Comment on attachment 161680 [details] [diff] [review]
Somewhat like this

>Index: extensions/transformiix/source/xslt/txMozillaStylesheetCompiler.cpp
>===================================================================

>+            rv = conpol->ShouldLoad(nsIContentPolicy::TYPE_STYLESHEET,
>+                                    aUri,
>+                                    referrerURI,
>+                                    // XXXbz do we have a document here?  Or
>+                                    // can we get a window off the loadgroup?
>+                                    // Or something for the context?
>+                                    nsnull,

mProcessor (a txMozillaXSLTProcessor) holds the source document (mSource), I'd
be fine with exposing it so you can get at it here.

>+                                    NS_LITERAL_CSTRING("text/xsl"),

Hmm, text/xsl doesn't really exist as a mimetype. We only accept it in the type
attribute of the stylesheet PI for compatibility with IE. text/xml?

>+                                    nsnull,
>+                                    &decision);

>+            if (decision != nsIContentPolicy::ACCEPT) {

Any reason why you're not using the helper functions and macros from
nsContentPolicyUtils.h in this file?

Comment 3

[Boris Zbarsky [:bzbarsky]]

> I'd be fine with exposing it so you can get at it here.

Sure.  Care to attach a patch so I can test?

> text/xml?

Sure.

> Any reason why you're not using the helper functions and macros

I wasn't sure I could include that header here.

Comment 4

[Peter Van der Beken [:peterv]]

Attachment: GetSourceContentModel

This should allow you to use mProcessor->GetSourceContentModel();

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch updated to comments, with fixed GetSourceContentModel

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 162545 [details] [diff] [review]
Patch updated to comments, with fixed GetSourceContentModel

r=me

do we want to add code for document() loaded documents as well. That's extra
datadocuments loaded by the xslt stylesheet.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Taking.

(In reply to comment #6)
> do we want to add code for document() loaded documents as well. That's extra
> datadocuments loaded by the xslt stylesheet.

I basically added the content policy check to the one place where XSLT called
CheckLoadURI.  Does it not call CheckLoadURI for document() loaded documents? 
If so, then we should indeed add both CheckLoadURI and content policy checks
there...

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed.  Sicking, want to file a followup on the document() issue?

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Filed 265901