636147 - Chrome privileges in the content scripts

Status: RESOLVED DUPLICATE of bug 601295

(Add-on SDK Graveyard :: General, defect, P1)

Description

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

At the moment all the content scripts do have an access to the `Components` object and there for to all the XPCOM capabilities due to the misbehavior of frameworks like jQuery if they are loaded in a sandbox with a non chrome privileges. This bug will help us not have that in mind.

Also I think that `new Cu.Sandbox(this._port.window)` may make a trick.

Comment 1

[Alexandre Poirot [:ochameau]]

Still needed and important!
It make some jquery unit tests fails on bug 616946.

Comment 2

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Comment for bug triage: I think it's important to have this fixed for 1.0 as users may start using chrome privileges from content scripts which is not only insecure but they will also break once this is fixed.

Comment 3

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Adding dependency on 601295 as Alex made some fixes that partially resolves this issue.

Comment 4

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Attachment: Pointer to Github pull request: https://github.com/mozilla/addon-sdk/pull/147

Pointer to Github pull-request

Comment 5

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Attachment: Pointer to Github pull request: https://github.com/mozilla/addon-sdk/pull/147#

Pointer to Github pull-request

Comment 6

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Comment on attachment 526736 [details]
Pointer to Github pull request: https://github.com/mozilla/addon-sdk/pull/147#

This pull request is still work in progress as not all of the jQuery test pass.

Comment 7

[Daniel Veditz [:dveditz]]

Flagging as a security bug. This seems to be counter to the goals of JetPacks. Could lead to review mistakes if add-on reviewers assume page-mods are relatively safe because they're "sandboxed". Likely to leak privileged objects into page content if the page-mod script creates objects to enhance the page -- wrappers and compartments might help, but history says those can be bypassable.

Comment 8

[Irakli Gozalishvili [:irakli] [:gozala] [@gozala]]

Marking this as a duplicate of 601295.