814153 - Need additional security checks for the "settings" permission

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Notes from conversation with gregor:

settings:
  settings-read and settings-write both checked in child for dom access, but returns non-null if access not granted (logs error to console only)
  doesn't assert permission before adding listeners ("Settings:RegisterForMessages")

We should tighten this up a little.

Comment 1

[Andrew Overholt [:overholt]]

Gregor, Doug said you should be the lucky owner of this bug.  Congrats!  :)

Comment 2

[Gregor Wagner [:gwagner]]

Attachment: patch

Comment 3

[Gregor Wagner [:gwagner]]

(In reply to ben turner [:bent] from comment #0)
> Notes from conversation with gregor:
> 
> settings:
>   settings-read and settings-write both checked in child for dom access, but
> returns non-null if access not granted (logs error to console only)

fixed by 815398

>   doesn't assert permission before adding listeners
> ("Settings:RegisterForMessages")

This patch

Comment 4

[Gregor Wagner [:gwagner]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a242c45cc80b

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/a242c45cc80b

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/5796235869f1
https://hg.mozilla.org/releases/mozilla-beta/rev/b1958d544900