673742 - Allow postMessage()ing File and FileLists between windows

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Patch

The attached patch allows the postMessage if and only if the caller's principal subsumes the target's, so I think we can do this without security review.

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 547980 [details] [diff] [review]
Patch

Review of attachment 547980 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with that fixed.

::: dom/base/nsGlobalWindow.cpp
@@ +6030,5 @@
> +    nsISupports* supports = wrappedNative->Native();
> +
> +    nsCOMPtr<nsIDOMBlob> blob = do_QueryInterface(supports);
> +    if (blob && scInfo->subsumes)
> +      scTag = SCTAG_DOM_FILE;

SCTAG_DOM_BLOB seems like a better name. Seems better to ensure that no-one casts to nsIDOMFile anywhere after checking this tag.

@@ +6277,5 @@
>    // We *must* clone the data here, or the jsval could be modified
>    // by script
>    JSAutoStructuredCloneBuffer buffer;
> +  StructuredCloneInfo scInfo;
> +  scInfo.event = event.get();

The .get() here shouldn't be needed.

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Going to write some tests and slip this into 8.

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/31eddfef6549

This still needs tests, which are blocked on some SpecialPowers enhancements :-/

Comment 4

[Eric Shepherd [:sheppy]]

Documentation updated:

https://developer.mozilla.org/en/DOM/window.postMessage

Also mentioned on Firefox 8 for developers.

Comment 5

[Sebastian Tschan]

Sorry for commenting on a closed bug, but I would like some clarification:
What exactly is meant by the following statement?

    "This is only allowed if the recipient's principal is contained within the sender's principal"

Does this mean that postMessage with File/Blob/FileList objects as data is not allowed for cross-domain communication?
Doesn't this contradict the following statement?

    "window.postMessage is a method for safely enabling cross-origin communication"

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Sebastian Tschan from comment #5)
> Sorry for commenting on a closed bug, but I would like some clarification:
> What exactly is meant by the following statement?
> 
>     "This is only allowed if the recipient's principal is contained within
> the sender's principal"
> 
> Does this mean that postMessage with File/Blob/FileList objects as data is
> not allowed for cross-domain communication?

Yes.

> Doesn't this contradict the following statement?
> 
>     "window.postMessage is a method for safely enabling cross-origin
> communication"

To some extent.  We plan to allow postMessaging Files and FileLists across origins, that just needs a more in depth security review.

Comment 7

[Jimmy Warting]

When is cross origins going to be implemented?