wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 17:03:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2736 - Part 2: Pass subject principal to SetAttribute and friends.

Browse source 
In order to tailor certain security checks to the caller that is
attempting to load a particular piece of content, we need to be able to
attach an appropriate triggering principal to the corresponding requests.

Since most HTML content is loaded based on attribute values, this means
capturing the subject principal of the caller who sets those attributes,
which in turn means we need to make it available to `AfterSetAttr` hooks
on all relevant element types.
This commit is contained in:
Moonchild 2025-04-27 20:42:29 +02:00 • committed by roytam1
commit 824d0cad58
88 changed files with 337 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

10
dom/html/HTMLScriptElement.cpp
View file

@ -232,13 +232,17 @@ HTMLScriptElement::SetNoModule(bool aValue, ErrorResult& aRv)
nsresult
HTMLScriptElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
const nsAttrValue* aValue,
const nsAttrValue* aOldValue, bool aNotify)
const nsAttrValue* aOldValue,
nsIPrincipal* aMaybeScriptedPrincipal,
bool aNotify)
{
if (nsGkAtoms::async == aName && kNameSpaceID_None == aNamespaceID) {
mForceAsync = false;
}
return nsGenericHTMLElement::AfterSetAttr(aNamespaceID, aName, aValue,
aOldValue, aNotify);
return nsGenericHTMLElement::AfterSetAttr(aNamespaceID, aName,
aValue, aOldValue,
aMaybeScriptedPrincipal,
aNotify);
}
NS_IMETHODIMP