wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-25 09:57:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2736 - Part 2: Pass subject principal to SetAttribute and friends.

Browse source 
In order to tailor certain security checks to the caller that is
attempting to load a particular piece of content, we need to be able to
attach an appropriate triggering principal to the corresponding requests.

Since most HTML content is loaded based on attribute values, this means
capturing the subject principal of the caller who sets those attributes,
which in turn means we need to make it available to `AfterSetAttr` hooks
on all relevant element types.
This commit is contained in:
Moonchild 2025-04-27 20:42:29 +02:00 • committed by roytam1
commit 824d0cad58
88 changed files with 337 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

17
dom/base/nsIContent.h
View file

@ -363,6 +363,16 @@ public:
{
return SetAttr(aNameSpaceID, aName, nullptr, aValue, aNotify);
}
nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName, nsIAtom* aPrefix,
const nsAString& aValue, bool aNotify)
{
return SetAttr(aNameSpaceID, aName, aPrefix, aValue, nullptr, aNotify);
}
nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName, const nsAString& aValue,
nsIPrincipal* aTriggeringPrincipal, bool aNotify)
{
return SetAttr(aNameSpaceID, aName, nullptr, aValue, aTriggeringPrincipal, aNotify);
}
/**
* Set attribute values. All attribute values are assumed to have a
@ -375,11 +385,18 @@ public:
* @param aName the name of the attribute
* @param aPrefix the prefix of the attribute
* @param aValue the value to set
* @param aMaybeScriptedPrincipal the principal of the scripted caller responsible
* for setting the attribute, or null if no scripted caller can be
* determined. A null value here does not guarantee that there is no
* scripted caller, but a non-null value does guarantee that a scripted
* caller with the given principal is directly responsible for the
* attribute change.
* @param aNotify specifies how whether or not the document should be
* notified of the attribute change.
*/
virtual nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
nsIAtom* aPrefix, const nsAString& aValue,
nsIPrincipal* aMaybeScriptedPrincipal,
bool aNotify) = 0;
/**