bug 102750 - Can't call JSIID.equals from web content. r=mstoltz, sr=jband

js/src/xpconnect/src/xpccomponents.cpp

@@ -70,11 +70,23 @@ JSValIsInterfaceOfType(JSContext *cx, jsval v, REFNSIID iid)
 }
 
 #ifdef XPC_USE_SECURITY_CHECKED_COMPONENT
-static char* CloneAllAccess()
+char* xpc_CloneAllAccess()
 {
     static const char allAccess[] = "AllAccess";
     return (char*)nsMemory::Clone(allAccess, sizeof(allAccess));
 }
+
+char * xpc_CheckAccessList(const PRUnichar* wideName, const char* list[])
+{
+    nsCAutoString asciiName;   
+    CopyUCS2toASCII(nsDependentString(wideName), asciiName);
+
+    for(const char** p = list; *p; p++)
+        if(!strcmp(*p, asciiName))
+            return xpc_CloneAllAccess();
+    
+    return nsnull;
+}
 #endif
 
 /***************************************************************************/
@@ -265,7 +277,7 @@ NS_IMETHODIMP
 nsXPCComponents_Interfaces::CanCreateWrapper(const nsIID * iid, char **_retval)
 {
     // We let anyone do this...
-    *_retval = CloneAllAccess();
+    *_retval = xpc_CloneAllAccess();
     return NS_OK;
 }
 
@@ -1762,7 +1774,7 @@ NS_IMETHODIMP
 nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval)
 {
     // We let anyone do this...
-    *_retval = CloneAllAccess();
+    *_retval = xpc_CloneAllAccess();
     return NS_OK;
 }
 
@@ -1779,15 +1791,8 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c
 NS_IMETHODIMP
 nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
 {
-    static const NS_NAMED_LITERAL_STRING(s_interfaces, "interfaces");
-    static const NS_NAMED_LITERAL_STRING(s_results, "results");
-
-    const nsDependentString name(propertyName);
-
-    if(name.Equals(s_interfaces) || name.Equals(s_results))
-        *_retval = CloneAllAccess();
-    else
-        *_retval = nsnull;
+    static const char* allowed[] = { "interfaces", "results", nsnull};
+    *_retval = xpc_CheckAccessList(propertyName, allowed);
     return NS_OK;
 }
 

js/src/xpconnect/src/xpcexception.cpp

@@ -497,17 +497,12 @@ nsXPCException::NewException(const char *aMessage,
 }
 
 #ifdef XPC_USE_SECURITY_CHECKED_COMPONENT
-static char* CloneAllAccess()
-{
-    static const char allAccess[] = "AllAccess";
-    return (char*)nsMemory::Clone(allAccess, sizeof(allAccess));
-}
 
 /* string canCreateWrapper (in nsIIDPtr iid); */
 NS_IMETHODIMP
 nsXPCException::CanCreateWrapper(const nsIID * iid, char **_retval)
 {
-    *_retval = CloneAllAccess();
+    *_retval = xpc_CloneAllAccess();
     return NS_OK;
 }
 
@@ -515,14 +510,9 @@ nsXPCException::CanCreateWrapper(const nsIID * iid, char **_retval)
 NS_IMETHODIMP
 nsXPCException::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
 {
-    static const NS_NAMED_LITERAL_STRING(s_toString, "toString");
+    static const char* allowed[] = { "toString", nsnull};
 
-    const nsDependentString name(methodName);
-
-    if(name.Equals(s_toString))
-        *_retval = CloneAllAccess();
-    else
-        *_retval = nsnull;
+    *_retval = xpc_CheckAccessList(methodName, allowed);
     return NS_OK;
 }
 
@@ -530,20 +520,10 @@ nsXPCException::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, ch
 NS_IMETHODIMP
 nsXPCException::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
 {
-    static const NS_NAMED_LITERAL_STRING(s_message, "message");
-    static const NS_NAMED_LITERAL_STRING(s_result , "result");
-    static const NS_NAMED_LITERAL_STRING(s_code   , "code");
-    static const NS_NAMED_LITERAL_STRING(s_name   , "name");
+    static const char* allowed[] = { "message", "result", "code", "name", 
+       nsnull};
 
-    const nsDependentString name(propertyName);
-
-    if(name.Equals(s_message) ||
-       name.Equals(s_result)  ||
-       name.Equals(s_code)    ||
-       name.Equals(s_name))
-        *_retval = CloneAllAccess();
-    else
-        *_retval = nsnull;
+    *_retval = xpc_CheckAccessList(propertyName, allowed);
     return NS_OK;
 }
 

js/src/xpconnect/src/xpcjsid.cpp

@@ -599,18 +599,12 @@ nsJSIID::HasInstance(nsIXPConnectWrappedNative *wrapper,
 }
 
 #ifdef XPC_USE_SECURITY_CHECKED_COMPONENT
-static char* CloneAllAccess()
-{
-    static const char allAccess[] = "AllAccess";
-    return (char*)nsMemory::Clone(allAccess, sizeof(allAccess));
-}
-
 /* string canCreateWrapper (in nsIIDPtr iid); */
 NS_IMETHODIMP
 nsJSIID::CanCreateWrapper(const nsIID * iid, char **_retval)
 {
     // We let anyone do this...
-    *_retval = CloneAllAccess();
+    *_retval = xpc_CloneAllAccess();
     return NS_OK;
 }
 
@@ -618,8 +612,9 @@ nsJSIID::CanCreateWrapper(const nsIID * iid, char **_retval)
 NS_IMETHODIMP
 nsJSIID::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
 {
-    // If you have to ask, then the answer is NO
-    *_retval = nsnull;
+    static const char* allowed[] = {"equals", "toString", nsnull};
+
+    *_retval = xpc_CheckAccessList(methodName, allowed);
     return NS_OK;
 }
 
@@ -627,8 +622,8 @@ nsJSIID::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_r
 NS_IMETHODIMP
 nsJSIID::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
 {
-    // If you have to ask, then the answer is NO
-    *_retval = nsnull;
+    static const char* allowed[] = {"name", "number", "valid", nsnull};
+    *_retval = xpc_CheckAccessList(propertyName, allowed);
     return NS_OK;
 }
 

js/src/xpconnect/src/xpcprivate.h

@@ -2971,6 +2971,17 @@ DEFINE_AUTO_MARKING_PTR_TYPE(AutoMarkingWrappedNativeProtoPtr, XPCWrappedNativeP
 // these and bind them to rooted things so immediately that this just is not
 // needed.
 
+#ifdef XPC_USE_SECURITY_CHECKED_COMPONENT
+/***************************************************************************/
+// Allocates a string that grants all access ("AllAccess")
+
+extern char* xpc_CloneAllAccess();
+/***************************************************************************/
+// Returns access if wideName is in list
+
+extern char * xpc_CheckAccessList(const PRUnichar* wideName, const char* list[]);
+#endif
+
 /***************************************************************************/
 // Inlined utilities.