author Brian Hackett <>
Sat, 07 Dec 2013 18:18:16 -0800
changeset 175074 70ec3658b113ffa3ee5d6a78aaa0a112cc1e378e
parent 160382 03174045ef8d72ab2a0486e656c988bb3644951d
child 200047 6c1c7e45c90289a0875b74f82f39e7ecf6a65af3
permissions -rw-r--r--
Bug 940635 - Don't allow Int32 conversions of both LHS and RHS in comparisons when their types are not actually known, r=shu.

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at */
/*Factory for internal browser security resource managers*/

#include "nsCOMPtr.h"
#include "nsIScriptSecurityManager.h"
#include "nsScriptSecurityManager.h"
#include "nsIPrincipal.h"
#include "nsPrincipal.h"
#include "nsSystemPrincipal.h"
#include "nsNullPrincipal.h"
#include "nsIScriptNameSpaceManager.h"
#include "nsIScriptContext.h"
#include "nsICategoryManager.h"
#include "nsXPIDLString.h"
#include "nsCOMPtr.h"
#include "nsIServiceManager.h"
#include "nsString.h"
#include "nsNetCID.h"
#include "nsIClassInfoImpl.h"
#include "nsJSUtils.h"
#include "nsPIDOMWindow.h"
#include "nsIScriptGlobalObject.h"
#include "nsIDocument.h"
#include "jsfriendapi.h"
#include "xpcprivate.h"
#include "nsCxPusher.h"
#include "mozilla/Preferences.h"
#include "mozilla/Telemetry.h"

using namespace mozilla;

// nsSecurityNameSet //



NS_IMPL_ISUPPORTS1(nsSecurityNameSet, nsIScriptExternalNameSet)

static bool
netscape_security_enablePrivilege(JSContext *cx, unsigned argc, JS::Value *vp)
    Telemetry::Accumulate(Telemetry::ENABLE_PRIVILEGE_EVER_CALLED, true);
    return xpc::EnableUniversalXPConnect(cx);

static const JSFunctionSpec PrivilegeManager_static_methods[] = {
    JS_FS("enablePrivilege", netscape_security_enablePrivilege, 1, 0),

 * "Steal" calls to,
 * et al. so that code that worked with 4.0 can still work.
nsSecurityNameSet::InitializeNameSet(nsIScriptContext* aScriptContext)
    AutoJSContext cx;
    JS::Rooted<JSObject*> global(cx, aScriptContext->GetWindowProxy());
    JSAutoCompartment ac(cx, global);

     * Find Object.prototype's class by walking up the global object's
     * prototype chain.
    JS::Rooted<JSObject*> obj(cx, global);
    JS::Rooted<JSObject*> proto(cx);
    for (;;) {
        MOZ_ALWAYS_TRUE(JS_GetPrototype(cx, obj, &proto));
        if (!proto)
        obj = proto;
    const JSClass *objectClass = JS_GetClass(obj);

    JS::Rooted<JS::Value> v(cx);
    if (!JS_GetProperty(cx, global, "netscape", &v))
        return NS_ERROR_FAILURE;

    JS::Rooted<JSObject*> securityObj(cx);
    if (v.isObject()) {
         * "netscape" property of window object exists; get the
         * "security" property.
        obj = &v.toObject();
        if (!JS_GetProperty(cx, obj, "security", &v) || !v.isObject())
            return NS_ERROR_FAILURE;
        securityObj = &v.toObject();
    } else {
        /* define object */
        obj = JS_DefineObject(cx, global, "netscape", objectClass, nullptr, 0);
        if (obj == nullptr)
            return NS_ERROR_FAILURE;
        securityObj = JS_DefineObject(cx, obj, "security", objectClass,
                                      nullptr, 0);
        if (securityObj == nullptr)
            return NS_ERROR_FAILURE;

    // We hide enablePrivilege behind a pref because it has been altered in a
    // way that makes it fundamentally insecure to use in production. Mozilla
    // uses this pref during automated testing to support legacy test code that
    // uses enablePrivilege. If you're not doing test automation, you _must_ not
    // flip this pref, or you will be exposing all your users to security
    // vulnerabilities.
    if (!Preferences::GetBool("security.turn_off_all_security_so_that_viruses_can_take_over_this_computer"))
        return NS_OK;

    /* Define PrivilegeManager object with the necessary "static" methods. */
    obj = JS_DefineObject(cx, securityObj, "PrivilegeManager", objectClass,
                          nullptr, 0);
    if (obj == nullptr)
        return NS_ERROR_FAILURE;

    return JS_DefineFunctions(cx, obj, PrivilegeManager_static_methods)
           ? NS_OK
           : NS_ERROR_FAILURE;