505915 - Throw when someone tries to unwrap a XOW they don't have access to

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Currently, given something like

var w = cross_origin_window; // XOW wrapped
document.body.appendChild(w);

we successfully call nsGenericElement::AppendChild and fail later on in that function. We should instead, bail in XPConnect when we detect the attempt to use the cross origin window.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 398279 [details] [diff] [review]
Proposed fix

This is overly pessimistic. New patch coming.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Better patch

Two things wrong with the previous patch:
  * It ignored quickstubs.
  * There are security wrappers that wrap non WrappedNatives. So (new XMLHttpRequest()).onreadystatechange = new XPCSafeJSObjectWrapper(function(){}) would throw because we wouldn't get a wrapped native from it *and* it was wrapped by a security wrapper. This patch fixes that problem (and avoids double-unwrapping the security wrapper).

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Best patch yet

I forgot to get rid of GetISupportsFromJSObject. I feel better now.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/a01f270b961a

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

I had to back this out to fix tinderbox orange.

Comment 7

[Peter Van der Beken [:peterv]]

I think you'll need to add code to deal with slim wrappers in XPCConvert::JSObject2NativeInterface, iirc they fall through to the GetISupportsFromJSObject call.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Yeah, they do. I added that call back and things seem to mostly work now.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/0071000d8c4c