From 1f638b22ec54b78a0dba9053d75431fb50010542 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Tue, 29 Apr 2025 09:47:42 +0200
Subject: [PATCH] Issue #2736 - Part 6: Re-work <script> `src` attribute.

Use subject principal as triggering principal in <script> "src" attribute.
---
 dom/html/HTMLScriptElement.cpp      | 15 ++++++++++-----
 dom/html/HTMLScriptElement.h        |  6 +++++-
 dom/script/ScriptLoader.cpp         | 29 +++++++++++++++++++----------
 dom/script/ScriptLoader.h           |  1 +
 dom/script/nsIScriptElement.h       | 11 +++++++++++
 dom/webidl/HTMLScriptElement.webidl |  2 +-
 6 files changed, 47 insertions(+), 17 deletions(-)

diff --git a/dom/html/HTMLScriptElement.cpp b/dom/html/HTMLScriptElement.cpp
index ef1fba7d7c..2b7eee510e 100644
--- a/dom/html/HTMLScriptElement.cpp
+++ b/dom/html/HTMLScriptElement.cpp
@@ -166,9 +166,9 @@ HTMLScriptElement::Defer()
 }
 
 void
-HTMLScriptElement::SetSrc(const nsAString& aSrc, ErrorResult& rv)
+HTMLScriptElement::SetSrc(const nsAString& aSrc, nsIPrincipal& aTriggeringPrincipal, ErrorResult& rv)
 {
-  rv = SetAttrHelper(nsGkAtoms::src, aSrc);
+  SetHTMLAttr(nsGkAtoms::src, aSrc, aTriggeringPrincipal, rv);
 }
 
 void
@@ -230,16 +230,21 @@ HTMLScriptElement::SetNoModule(bool aValue, ErrorResult& aRv)
 }
 
 nsresult
-HTMLScriptElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+HTMLScriptElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aMaybeScriptedPrincipal,
                                 bool aNotify)
 {
-  if (nsGkAtoms::async == aName && kNameSpaceID_None == aNamespaceID) {
+  if (aName == nsGkAtoms::async && aNameSpaceID == kNameSpaceID_None) {
     mForceAsync = false;
   }
-  return nsGenericHTMLElement::AfterSetAttr(aNamespaceID, aName,
+  if (aName == nsGkAtoms::src && aNameSpaceID == kNameSpaceID_None) {
+    mSrcTriggeringPrincipal = nsContentUtils::GetAttrTriggeringPrincipal(
+        this, aValue ? aValue->GetStringValue() : EmptyString(),
+        aMaybeScriptedPrincipal);
+  }
+  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName,
                                             aValue, aOldValue,
                                             aMaybeScriptedPrincipal,
                                             aNotify);
diff --git a/dom/html/HTMLScriptElement.h b/dom/html/HTMLScriptElement.h
index 12d4163be6..05fdaab5e7 100644
--- a/dom/html/HTMLScriptElement.h
+++ b/dom/html/HTMLScriptElement.h
@@ -67,7 +67,11 @@ public:
   void SetCharset(const nsAString& aCharset, ErrorResult& rv);
   void SetDefer(bool aDefer, ErrorResult& rv);
   bool Defer();
-  void SetSrc(const nsAString& aSrc, ErrorResult& rv);
+  void GetSrc(nsString& aSrc, nsIPrincipal&)
+  {
+    GetSrc(aSrc);
+  };
+  void SetSrc(const nsAString& aSrc, nsIPrincipal& aTriggeringPrincipal, ErrorResult& rv);
   void SetType(const nsAString& aType, ErrorResult& rv);
   void SetHtmlFor(const nsAString& aHtmlFor, ErrorResult& rv);
   void SetEvent(const nsAString& aEvent, ErrorResult& rv);
diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
index dc07d47781..d577eb540b 100644
--- a/dom/script/ScriptLoader.cpp
+++ b/dom/script/ScriptLoader.cpp
@@ -869,6 +869,8 @@ ScriptLoader::StartFetchingModuleAndDependencies(ModuleLoadRequest* aParent,
   RefPtr<ModuleLoadRequest> childRequest =
       ModuleLoadRequest::CreateStaticImport(aURI, aParent);
 
+  childRequest->mTriggeringPrincipal = aParent->mTriggeringPrincipal;
+
   aParent->mImports.AppendElement(childRequest);
 
   RefPtr<GenericPromise> ready = childRequest->mReady.Ensure(__func__);
@@ -1329,15 +1331,16 @@ ScriptLoader::StartLoad(ScriptLoadRequest *aRequest, const nsAString &aType,
   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 
   nsCOMPtr<nsIChannel> channel;
-  nsresult rv = NS_NewChannel(getter_AddRefs(channel),
-                              aRequest->mURI,
-                              context,
-                              securityFlags,
-                              contentPolicyType,
-                              loadGroup,
-                              prompter,
-                              nsIRequest::LOAD_NORMAL |
-                              nsIChannel::LOAD_CLASSIFY_URI);
+  nsresult rv = NS_NewChannelWithTriggeringPrincipal(
+      getter_AddRefs(channel),
+      aRequest->mURI,
+      context,
+      aRequest->mTriggeringPrincipal,
+      securityFlags,
+      contentPolicyType,
+      loadGroup,
+      prompter,
+      nsIRequest::LOAD_NORMAL);
 
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1638,10 +1641,14 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         }
       }
 
-      nsCOMPtr<nsIPrincipal> principal = scriptContent->NodePrincipal();
+      nsCOMPtr<nsIPrincipal> principal = aElement->GetScriptURITriggeringPrincipal();
+      if (!principal) {
+        principal = scriptContent->NodePrincipal();
+      }
 
       request = CreateLoadRequest(scriptKind, scriptURI, aElement, principal,
                                   ourCORSMode, sriMetadata, referrerPolicy);
+      request->mTriggeringPrincipal = Move(principal);
       request->mIsInline = false;
       request->SetScriptMode(aElement->GetScriptDeferred(),
                              aElement->GetScriptAsync());
@@ -1764,6 +1771,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                               SRIMetadata(), // SRI doesn't apply
                               referrerPolicy);
   request->mIsInline = true;
+  request->mTriggeringPrincipal = mDocument->NodePrincipal();
   request->mLineNo = aElement->GetScriptLineNumber();
 
   // Only the 'async' attribute is heeded on an inline module script and
@@ -3077,6 +3085,7 @@ ScriptLoader::PreloadURI(nsIURI *aURI,
                       mDocument->NodePrincipal(),
                       Element::StringToCORSMode(aCrossOrigin), sriMetadata,
                       aReferrerPolicy);
+  request->mTriggeringPrincipal = mDocument->NodePrincipal();
   request->mIsInline = false;
   request->SetScriptMode(aDefer, aAsync);
   request->SetIsPreloadRequest();
diff --git a/dom/script/ScriptLoader.h b/dom/script/ScriptLoader.h
index f66c9ede1d..80248e2dc9 100644
--- a/dom/script/ScriptLoader.h
+++ b/dom/script/ScriptLoader.h
@@ -248,6 +248,7 @@ public:
   char16_t* mScriptTextBuf; // Holds script text for non-inline scripts. Don't
   size_t mScriptTextLength; // use nsString so we can give ownership to jsapi.
   const nsCOMPtr<nsIURI> mURI;
+  nsCOMPtr<nsIPrincipal> mTriggeringPrincipal;
   nsCOMPtr<nsIPrincipal> mOriginPrincipal;
   nsAutoCString mURL;     // Keep the URI's filename alive during off thread parsing.
   int32_t mLineNo;
diff --git a/dom/script/nsIScriptElement.h b/dom/script/nsIScriptElement.h
index 6a6f985d33..3149f79cc1 100644
--- a/dom/script/nsIScriptElement.h
+++ b/dom/script/nsIScriptElement.h
@@ -68,6 +68,12 @@ public:
     return mUri;
   }
 
+  nsIPrincipal* GetScriptURITriggeringPrincipal()
+  {
+    NS_PRECONDITION(mFrozen, "Not ready for this call yet!");
+    return mSrcTriggeringPrincipal;
+  }
+
   /**
    * Script source text for inline script elements.
    */
@@ -363,6 +369,11 @@ protected:
    */
   nsCOMPtr<nsIURI> mUri;
 
+  /**
+   * The triggering principal for the src URL.
+   */
+  nsCOMPtr<nsIPrincipal> mSrcTriggeringPrincipal;
+
   /**
    * The creator parser of a non-defer, non-async parser-inserted script.
    */
diff --git a/dom/webidl/HTMLScriptElement.webidl b/dom/webidl/HTMLScriptElement.webidl
index bb9618428a..b9f5a2922a 100644
--- a/dom/webidl/HTMLScriptElement.webidl
+++ b/dom/webidl/HTMLScriptElement.webidl
@@ -10,7 +10,7 @@
 
 [HTMLConstructor]
 interface HTMLScriptElement : HTMLElement {
-  [CEReactions, SetterThrows]
+  [CEReactions, NeedsSubjectPrincipal, SetterThrows]
   attribute DOMString src;
   [CEReactions, SetterThrows]
   attribute DOMString type;