976151 - Anti eval/Function() check during wrapping should use |subsumes|

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

We have this just-in-case check against creating a cross-compartment wrapper to either eval or the Function constructor from a privileged page. Currently, this just checks if the wrapper would be a COW, but that's suboptimal for two reasons:

(1) When we implement Xrays-to-Functions, this check will be wrong.
(2) Now that we have asymmetric privilege relationships with non-chrome principals (i.e nsIExpandedPrincipal), we want the logic to cover all non-subsuming cases, not just content->chrome.

This isn't a security problem, just the improvement of a belt-and-braces check. I'll write up a patch.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Anti eval/Function() check during wrapping should use |subsumes|. v1

Comment 2

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=43a9d95e4e29

Comment 3

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9a8a8a73df71

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/9a8a8a73df71