515475 - Remove security check from js_InternalGetOrSet

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

This was added because otherwise there would be no call out to the embedding when accessing a cross-origin object's getter (see bug 92773). I'll attach a testcase showing the problem and explaining why the check isn't useful in a second.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Test + fix

Before XOWs, cross-origin checking was accomplished through nsWindowSH::GetProperty and related hooks. The problem pointed out in bug 92773 is that when someone sets a getter or setter on a property, subsequent gets and sets of that property don't go through the hooks, they call the getter directly, bypassing the security checks that we'd otherwise do. Now, XOWs take care of this by imposing a barrier between the getter or setter and the object that the cross-origin window has.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 399588 [details] [diff] [review]
Test + fix

Yay. Anything like this to eliminate under separate bug(s)?

/be

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/4448e1b581b7

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

There probably are. I'll do a separate pass to find them.