370113 - Use nsIPrincipal APIs instead of CheckSameOriginPrincipal

Status: NEW

(Core :: Security, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Very few callers of CheckSameOriginPrincipal want to actually do a same-origin check.  The ones that do should be using Equals(), at least once bug 369201 is fixed.

I think we should eliminate CheckSameOriginPrincipal, in fact.

Comment 1

[Boris Zbarsky [:bzbarsky]]

One issue here might be that some people are doing CheckSameOriginPrincipal when they really only have a principal and a URI (e.g. XForms comes to mind).  We probably need a separate API for that...

Also, I think a lot of the nsDocument checks should be ownerDocument compares, not same-origin compares.

And then we need to figure out whether we need a separate method on nsContentUtils for subsumes() testing vs same-origin testing.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I actually do think we should block on this -- we have existing security issues we can't really fix until we fix this bug.  That said, fixing this once bug 369201 lands is a pretty high priority for me, so I'll probably just do it.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Please do mark depending security bugs as depending and we'll revisit at some point down the road. Or just fix it of course :)

Comment 4

[Boris Zbarsky [:bzbarsky]]

Patch in bug 418996 rips this API out.