38684 - "security.checkxpconnect" pref is disabled

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect, P3)

Description

[rusty.lynch]

Making a pref entry for "security.checkxpconnect" to false will not allow
xpconnect calls from JavaScript.

The problem is that  nsScriptSecurityManager::CheckXPCPermissions() will fail
on it's prefs->GetBoolPref() call because mIsAccessingPrefs was never set to
PR_TRUE.

A patch for this follows...

Comment 1

[rusty.lynch]

Attachment: apply to mozilla/caps/src/nsScriptSecurityManager.cpp

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Rusty,
   The ability to bypass the CheckXPConnect pref is going away before M16. It was 
put in (and marked temporary in the code) for convenience during development, but 
it's going to go away very soon. As an alternative, add the pref 
user_pref("signed.applets.codebase_principal_support", true); 
during development, and make sure your javascript code does a 
netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
You'll get a confirmation dialog the first time you run this, just click 
"remember this decision" and you won't see it again. In the release version, only 
signed scripts will have access to XPConnect. I'm closing this bug.

Comment 3

[John Unruh]

Verified per mstoltz's comments.