From 09b3c7a2d8f30b849f1f845733e20d7b6aa694a8 Mon Sep 17 00:00:00 2001
From: FranklinDM <mrmineshafter17@gmail.com>
Date: Thu, 25 Jan 2024 13:40:39 +0800
Subject: [PATCH] Issue #2578 - Part 1: Implement preference for controlling
 same-origin policy

---
 caps/nsScriptSecurityManager.cpp | 8 +++++++-
 caps/nsScriptSecurityManager.h   | 1 +
 modules/libpref/init/all.js      | 3 +++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
index e7dedba8fa..7394bf0f74 100644
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -76,6 +76,7 @@ nsIIOService    *nsScriptSecurityManager::sIOService = nullptr;
 nsIStringBundle *nsScriptSecurityManager::sStrBundle = nullptr;
 JSContext       *nsScriptSecurityManager::sContext   = nullptr;
 bool nsScriptSecurityManager::sStrictFileOriginPolicy = true;
+bool nsScriptSecurityManager::sSameOriginPolicy = true;
 
 ///////////////////////////
 // Convenience Functions //
@@ -607,7 +608,7 @@ nsScriptSecurityManager::CheckSameOriginURI(nsIURI* aSourceURI,
                                             nsIURI* aTargetURI,
                                             bool reportError)
 {
-    if (!SecurityCompareURIs(aSourceURI, aTargetURI))
+    if (sSameOriginPolicy && !SecurityCompareURIs(aSourceURI, aTargetURI))
     {
          if (reportError) {
             ReportError(nullptr, NS_LITERAL_STRING("CheckSameOriginError"),
@@ -1434,10 +1435,13 @@ nsScriptSecurityManager::CanGetService(JSContext *cx,
 const char sJSEnabledPrefName[] = "javascript.enabled";
 const char sFileOriginPolicyPrefName[] =
     "security.fileuri.strict_origin_policy";
+const char sSameOriginPolicyPrefName[] =
+    "security.same_origin_policy.enabled";
 
 static const char* kObservedPrefs[] = {
   sJSEnabledPrefName,
   sFileOriginPolicyPrefName,
+  sSameOriginPolicyPrefName,
   "capability.policy.",
   nullptr
 };
@@ -1593,6 +1597,8 @@ nsScriptSecurityManager::ScriptSecurityPrefChanged()
         Preferences::GetBool(sJSEnabledPrefName, mIsJavaScriptEnabled);
     sStrictFileOriginPolicy =
         Preferences::GetBool(sFileOriginPolicyPrefName, false);
+    sSameOriginPolicy =
+        Preferences::GetBool(sSameOriginPolicyPrefName, true);
     mFileURIWhitelist.reset();
 }
 
diff --git a/caps/nsScriptSecurityManager.h b/caps/nsScriptSecurityManager.h
index b1953291db..1455276538 100644
--- a/caps/nsScriptSecurityManager.h
+++ b/caps/nsScriptSecurityManager.h
@@ -152,6 +152,7 @@ private:
     }
 
     static bool sStrictFileOriginPolicy;
+    static bool sSameOriginPolicy;
 
     static nsIIOService    *sIOService;
     static nsIStringBundle *sStrBundle;
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index ab47fed8b7..d687d9faf9 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1338,6 +1338,9 @@ pref("javascript.options.streams", true);
 pref("advanced.mailftp",                    false);
 pref("image.animation_mode",                "normal");
 
+// Same-origin policy for all URIs.
+pref("security.same_origin_policy.enabled", true);
+
 // Same-origin policy for file URIs, "false" is traditional
 pref("security.fileuri.strict_origin_policy", true);