nsJSUtils::GetCallingLocation doesn't deal with null principals well

RESOLVED FIXED in mozilla1.9beta4

Status

()

Core
DOM
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: mrbkap, Assigned: mrbkap)

Tracking

({verified1.8.1.13})

Trunk
mozilla1.9beta4
x86
Linux
verified1.8.1.13
Points:
---
Bug Flags:
blocking1.9 +
blocking1.8.1.13 +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed on branch by 411092)

Attachments

(1 attachment)

(Assignee)

Description

10 years ago
In bug 411092, I added some code that assumed that all scripts have principals. In theory, that's nice, but in practice, event handlers (such as <body onload>) do not have principals. This was causing the test boxes to go orange. I checked in a null check to avoid the crash and the null check is correct for the common case, but I worry that it might not always be correct.
Version: unspecified → Trunk
(Assignee)

Comment 1

10 years ago
Created attachment 300245 [details] [diff] [review]
Proposed fix

This patch makes us use the callee object if there are no principals in the script. I think that we want to use the script principals over the callee because the filename will be privileged even if the callee has been cloned into an untrusted context.

jst, if you agree, could you approve this as well?
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED
Attachment #300245 - Flags: superreview?(jst)
Attachment #300245 - Flags: review?(jst)

Updated

10 years ago
Attachment #300245 - Flags: superreview?(jst)
Attachment #300245 - Flags: superreview+
Attachment #300245 - Flags: review?(jst)
Attachment #300245 - Flags: review+
(Assignee)

Updated

10 years ago
Attachment #300245 - Flags: approval1.9?

Updated

10 years ago
Attachment #300245 - Flags: approval1.9? → approval1.9+

Updated

10 years ago
Flags: blocking1.9+
Target Milestone: --- → mozilla1.9beta4
Blake, do you want me to land this one for you?
Fix checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Flags: blocking1.8.1.13+
Whiteboard: fixed on branch by 411092
branch version of 411092 checked in.
Keywords: fixed1.8.1.13
Verified in bug 411092.
Keywords: fixed1.8.1.13 → verified1.8.1.13
You need to log in before you can comment on or make changes to this bug.