86799 - make it easier to block a property for a class and its descendants

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect, P2)

Description

[Jesse Ruderman]

There should be a way to block access to a property of a class and all of the
classes that inherit from that class.  This would make it much easier to fix:

bug 66938 block access to the innerHTML property of each inheritor of
HTMLElement for mail
bug 84545 block access to the baseURI property of each inheritor of Node for mail

Here's what I tried:

user_pref("capability.policy.default.HTMLElement.innerHTML", "noAccess");
user_pref("capability.policy.default.HTMLAnchorElement.innerHTML", "noAccess");

I couldn't access the innerHTML of a link, but I was still able to access the
innerHTML of an HTMLTableElement.  If I use the same pref in 0.9 (before
XPCDOM), but with htmlelement.innerhtml instead of HTMLElement.innerHTML
(because of the syntax changes that came with XPCDOM), it does successfully
block access to the innerHTML of all HTML elements.

I talked to jst and he said that because of the way XPConnect handles
inheritance, it's going to be hard to make this feature work with XPCDOM.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.4, Priority P2.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

I have a patch which allows for wildcard policies of the form
"capability.policy.groupname.*.propertyname". This will allow us to block the
innerHTML property of all classes, for example. This will allow us to fix
various security-related problems in mailnews.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch - wildcard support & pref changes for mail

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Attachment: Changed functions in nsscriptsecuritymanager (easier to read than the patch)

Comment 5

[Johnny Stenback (:jst)]

I sat down with mstoltz and looked at this and with a few minor modifications,
mostly stylistic, which he made in hes tree, sr=jst

Comment 6

[harishd]

Replace copy intialization with direct intialization. Other than that r=harishd

Comment 7

[Asa Dotzler [:asa]]

a=asa on behalf of drivers. mitch, can you make sure that this is well tested in
the resulting builds. they are large changes and we'd like to see them land. thanks.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch with reviewers' suggestions

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Fix checked in.

Comment 10

[cls]

This checkin broke the irix, aix & hpux tinderboxes.  Apparently, they don't
like casting from a void * to a int16.  You may need to do an explicit cast
using the NS_PTR_TO_INT32 macro recently added to nscore.h to get around the
bustage.  

<Insert std disclaimer regarding assuming void * are 32bits.  We need to support
64bit builds as well.>

Comment 11

[John Bandhauer]

I checked in a fix like cls suggested to try to fix this bustage.

Comment 12

[bsharma]

Marking verified as per above developer comments.