572953 - Cu.evalInSandbox should not ignore wrappedJSObject

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[David Dahl :ddahl]

in a snippet like this:

 this.sandbox = new Cu.Sandbox(this._window);
 this.sandbox.window = this._window;
 this.sandbox.__proto__ = this._window.wrappedJSObject;

when running:

Cu.evalInSandbox(str, this.sandbox);

The wrappedJSObject is ignored.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Ignored in what sense?

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

As part of bug 386635, content sandbox objects are returned in SJOWs. SJOWs wrap objects across boundaries, so if GreaseMonkey did:

sandbox.__proto__ = new XPCNativeWrapper(contentWindow);

sandbox's proto would end up being a XOW around the content window instead of the intended XPCNW. In order to fix that, I detect that case and "fix" it. Unfortunately, if you're not GreaseMonkey, it has very unexpected behavior. We need to come up with a clean way of setting up a sandbox whose wrapping behavior is well-defined.

Comment 3

[Julian Viereck]

TODO: When this bug is fixed, remove the workaround introduced in bug 574033.

Comment 4

[Johnny Stenback (:jst)]

Doesn't sound like something that must be fixed for Firefox 4.

Comment 5

[David Dahl :ddahl]

we do have a work around, so unless further testing shows otherwise we can do without. Our workaround is a bit hacky, perhaps someone can take a peek at bug 574033 and let us know if we are being insecure?

Comment 6

[Johnny Stenback (:jst)]

Is this still relevant after the compartments landing, with the evalInSandbox API changes etc?

Comment 8

[David Dahl :ddahl]

We just have to test with the new API. Our current code looks like:
http://mxr.mozilla.org/mozilla-central/source/toolkit/components/console/hudservice/HUDService.jsm?force=1#4142

4142   createSandbox: function JST_setupSandbox()
4143   {
4144     // create a JS Sandbox out of this.context
4145     this.sandbox = new Cu.Sandbox(this._window);
4146     this.sandbox.window = this._window;
4147     this.sandbox.console = this.console;
4148     this.sandbox.__helperFunctions__ = JSTermHelper(this);
4149     this.sandbox.__proto__ = this._window.wrappedJSObject;
4150   },

I think mrbkap said to do it like this instead:

this.sandbox = new Cu.Sandbox(this._window, this._window, false);
this.sandbox.window = this._window;
this.sandbox.console = this.console;

Is that right?

Comment 9

[Johnny Stenback (:jst)]

We need this for beta7 per mrbkap.

Comment 10

[Johnny Stenback (:jst)]

Though this was actually fixed by peterv's changes in bug 604957 and the changes to make the webconsole use the correct sandbox constructor.