wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-06 07:48:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2736 - Part 1: Provide more consistent principals to CSP.

Browse source 
We're currently fairly vague and inconsistent about the values we provide to
content policy implementations for requestOrigin and requestPrincipal. In some
cases they're the triggering principal, sometimes the loading principal,
sometimes the channel principal.

Our existing content policy implementations which require or expect a
loading principal currently retrieve it from the context node.
Since no current callers require the principal to be the loading
principal, and some already expect it to be the triggering principal
(which there's currently no other way to retrieve), a choice was made
to pass the triggering principal whenever possible, but use the loading
principal to determine the origin URL.
This commit is contained in:
Moonchild 2025-04-26 20:07:16 +02:00 • committed by roytam1
commit 9ad680cfc4
18 changed files with 109 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

44
layout/style/Loader.cpp
View file

@ -1028,14 +1028,15 @@ Loader::ObsoleteSheet(nsIURI* aURI)
}
nsresult
Loader::CheckContentPolicy(nsIPrincipal* aSourcePrincipal,
nsIURI* aTargetURI,
nsISupports* aContext,
bool aIsPreload)
Loader::CheckContentPolicy(nsIPrincipal* aLoadingPrincipal,
nsIPrincipal* aTriggeringPrincipal,
nsIURI* aTargetURI,
nsISupports* aContext,
bool aIsPreload)
{
// When performing a system load (e.g. aUseSystemPrincipal = true)
// then aSourcePrincipal == null; don't consult content policies.
if (!aSourcePrincipal) {
// then aLoadingPrincipal == null; don't consult content policies.
if (!aLoadingPrincipal) {
return NS_OK;
}
@ -1046,7 +1047,8 @@ Loader::CheckContentPolicy(nsIPrincipal* aSourcePrincipal,
int16_t shouldLoad = nsIContentPolicy::ACCEPT;
nsresult rv = NS_CheckContentLoadPolicy(contentPolicyType,
aTargetURI,
aSourcePrincipal,
aLoadingPrincipal,
aTriggeringPrincipal,
aContext,
NS_LITERAL_CSTRING("text/css"),
nullptr, //extra param
@ -2039,15 +2041,20 @@ Loader::LoadStyleLink(nsIContent* aElement,
NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_INITIALIZED);
nsIPrincipal* principal =
aElement ? aElement->NodePrincipal() : mDocument->NodePrincipal();
nsIPrincipal* loadingPrincipal = aElement ? aElement->NodePrincipal()
: mDocument->NodePrincipal();
//SHOULD BE:
//nsIPrincipal* principal = aTriggeringPrincipal ? aTriggeringPrincipal
// : loadingPrincipal;
nsIPrincipal* principal = loadingPrincipal;
nsISupports* context = aElement;
if (!context) {
context = mDocument;
}
nsresult rv = CheckContentPolicy(principal, aURL, context, false);
nsresult rv = CheckContentPolicy(loadingPrincipal, principal, aURL, context, false);
if (NS_WARN_IF(NS_FAILED(rv))) {
// Don't fire the error event if our document is loaded as data. We're
// supposed to not even try to do loads in that case... Unfortunately, we
@ -2188,13 +2195,18 @@ Loader::LoadChildSheet(StyleSheet* aParentSheet,
owningNode = topSheet->GetOwnerNode();
}
nsISupports* context = owningNode;
if (!context) {
nsISupports* context = nullptr;
nsIPrincipal* loadingPrincipal = nullptr;
if (owningNode) {
context = owningNode;
loadingPrincipal = owningNode->NodePrincipal();
} else if (mDocument) {
context = mDocument;
loadingPrincipal = mDocument->NodePrincipal();
}
nsIPrincipal* principal = aParentSheet->Principal();
nsresult rv = CheckContentPolicy(principal, aURL, context, false);
nsresult rv = CheckContentPolicy(loadingPrincipal, principal, aURL, context, false);
NS_ENSURE_SUCCESS(rv, rv);
SheetLoadData* parentData = nullptr;
@ -2351,7 +2363,11 @@ Loader::InternalLoadNonDocumentSheet(nsIURI* aURL,
return NS_ERROR_NOT_AVAILABLE;
}
nsresult rv = CheckContentPolicy(aOriginPrincipal, aURL, mDocument, aIsPreload);
nsCOMPtr<nsIPrincipal> loadingPrincipal = (aOriginPrincipal && mDocument
? mDocument->NodePrincipal()
: nullptr);
nsresult rv = CheckContentPolicy(loadingPrincipal, aOriginPrincipal,
aURL, mDocument, aIsPreload);
NS_ENSURE_SUCCESS(rv, rv);
StyleSheetState state;